At an estimated USD 6.3 billion in nominal terms, the Binance hack is the largest attack in crypto history and more than four times the size of Bybit's previous record. As a result, the exchange suspended withdrawals and plans to cover all losses itself.
Binance operates a centralized crypto exchange that combines trading in digital assets with custody of customer funds. Unlike with decentralized protocols, deposits sit in wallets that the company controls itself. In 2023, the platform pleaded guilty in the US to violating anti-money laundering rules. It also paid a penalty of USD 4.3 billion. Founder Changpeng Zhao stepped down. In 2025, the US president eventually pardoned him. Back in 2019, the exchange had already lost around 7,000 BTC in a hot wallet hack. At the time, the coins were worth about USD 40 million. Its emergency fund SAFU (Secure Asset Fund for Users) covered the damage in full. However, Binance describes the current figure of USD 6.3 billion as an estimate of the impact, not a confirmed amount stolen. On-chain, analytics firm Arkham also links nearly USD 6 billion in Bitcoin, Ether, Solana and stablecoins to 55 addresses.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
The Binance hack exceeds Bybit by a factor of 4.2
The previous record belonged to Bybit. In February 2025, attackers took around USD 1.5 billion in Ether from one of its cold wallets. The Binance estimate is therefore around 4.2 times as high. At Bybit, the entry point was a compromised software supply chain at SafeWallet. A few days later, the FBI attributed the attack to North Korea and referred to the activity as TraderTraitor. In total, attackers stole around USD 2.9 billion in about 150 attacks in 2025, according to data from TRM Labs. The damage at Binance alone is thus more than twice this annual total. By comparison, the next-largest cases like Ronin, Poly Network and Coincheck look small at around USD 530 to 620 million.
Several of the major cases hit blockchain protocols rather than exchanges. In March 2022, funds worth almost USD 620 million flowed out of Ronin, the blockchain behind the game Axie Infinity. The US Treasury Department held North Korea's Lazarus Group responsible. At Poly Network, a vulnerability between several blockchains cost around USD 610 million in August 2021. But the attackers returned almost all of the loot. The BNB Chain exploit in October 2022 falls into the same range, at around USD 570 million in nominal terms. Yet at the time, Binance founder Zhao estimated the outflow at only around USD 100 million. Wormhole lost around USD 320 million in February 2022. Jump Crypto, the crypto arm of Jump Trading, later replaced the funds.
Among exchanges, Coincheck lost around USD 530 million in the cryptocurrency NEM from a hot wallet in January 2018. Bitget reported an outflow of more than USD 350 million from hot and warm wallets as recently as September 2026. Mt. Gox put its losses at around 850,000 BTC, which disappeared between 2011 and 2014. At the time, that was worth around USD 450 to 500 million. The exchange eventually filed for bankruptcy in early 2014. Shortly afterwards, it found around 200,000 BTC in an old wallet. All amounts cited reflect dollar values at the time, so the comparison is only nominal. Valued at today's Bitcoin prices, however, the bankrupt exchange's loss would be many times higher than the Binance estimate. Bybit, Coincheck, Bitget and Mt. Gox also operated as centralized exchanges. Yet none of them lost nearly as much as Binance in nominal terms.
A compromised laptop as a possible entry point
According to initial findings, a DevOps engineer's compromised laptop may have given the attackers access to a service container. Such a container is an isolated software environment in which individual services of the platform run. From there, the attackers were presumably able to trigger unauthorized withdrawals. Still, it remains unclear how they took over the computer. By its own account, Binance found no evidence of a leak of the wallets' private keys. At the same time, the exchange revoked the affected address's authorization and brought in law enforcement and blockchain analytics firms. It also announced a detailed technical analysis of the failure and an updated proof of reserves.
TRM Labs attributes the attack with high confidence to the North Korean group TraderTraitor. The same group was previously behind the Bybit hack. Chainalysis, too, sees North Korea as the likely perpetrator with high confidence. As evidence, the firm points out that the funds mixed with the loot from the Bitget hack in September. In that attack, Bitget CEO Gracy Chen had likewise named North Korea as the very likely perpetrator. Nevertheless, both attributions in the Binance hack remain assessments by private analytics firms. So far, no finding by authorities has emerged, as one did in the Bybit case.
Notably, the attacker put part of the loot back to work. The attacker deposited 60 million USDT with the lending protocol Aave. Against this collateral, they borrowed around USD 44.6 million in Wrapped Ether. Aave then restricted the affected markets. Moreover, the exact amount of the damage remains open. Chainalysis first put it at a minimum of USD 5.9 billion, then at USD 6.4 billion. The more recent figure is slightly above Binance's own estimate.
How much Binance has already frozen
Binance puts the funds located or frozen so far at around USD 3 billion. In a post on X, however, the exchange cited USD 2.54 billion as the verified frozen amount. Stablecoin issuers blocked the largest share. Because they issue their tokens, they can block individual addresses. Tether froze around USD 1.57 billion, Circle around USD 823 million. Together, the two issuers therefore account for around USD 2.4 billion. At both companies, CEOs Paolo Ardoino and Jeremy Allaire confirmed the freezes. In addition, Ripple stopped around USD 200 million in its stablecoin RLUSD, according to Binance co-founder Yi He.
As a result, around USD 3.3 billion remains unaccounted for. Initially, there was no new information on the whereabouts of this sum. Binance plans to cover the losses once again from the SAFU fund and from company funds. By comparison, the total damage is more than 100 times the 2019 loss.
"Binance will cover all hacking losses." - Yi He, co-founder of Binance
Withdrawals remain suspended until further notice. The exchange has also paused trading on Binance Alpha. It has held out the prospect of a restart within 48 hours. Even so, it made no firm commitment.
Bitcoin, BNB and crypto stocks decline
Crypto markets reacted to the incident with losses. In the hours after the news, Bitcoin fell to a six-week low and Ether to a two-month low. The size of the drop depended on the point of measurement. By contrast, BNB, the token of the Binance ecosystem, fell much more sharply. Its utility depends heavily on the platform.
On Wall Street, crypto-related stocks, including Coinbase and Strategy, came under pressure in after-hours trading. Shares of Circle, the issuer of the stablecoin USDC, declined too. The company had itself frozen part of the loot beforehand. Overall, the declines in BNB and the crypto stocks were mostly steeper than in Bitcoin and Ether.
![ICE wants to offer regulated Hyperliquid perps to US retail investors through Trade[XYZ], a firm in which Stan Druckenmiller has invested.](https://cryptovalleyjournal.com/wp-content/uploads/2026/03/CVJ.CH-NYSE-ICE-OKX-450x300.jpg "ICE plans to bring Hyperliquid perps to the US with Trade[XYZ]")
