A breach at Binance has hit an estimated $6.3 billion in assets, the company says, and analysts call it the largest crypto theft on record. Binance has frozen about $3 billion of it with partners, and one of its co-founders has promised that the exchange will make users whole.
If you hold coins there, the immediate issue is access: Binance paused withdrawals while its security team works out how the attacker got in, and it has said little about the other $3.3 billion.
An engineer’s laptop is the first suspect
Binance’s early theory is that one engineer’s laptop was compromised, which gave the attacker a route into an internal system and the ability to move funds out without authorisation. The company says the incident “stems from multiple factors” and that it is still tracing the full path. According to a Reuters report, which we read in Dawn’s copy, Binance said deposits and withdrawals were suspended as a precaution while it secures its wallet infrastructure with police and industry partners.
Another newspaper’s copy of the same wire story adds that Binance expects withdrawals back within 48 hours and says deposits were unaffected. Since the versions disagree on deposits, treat that 48-hour figure as Binance’s estimate, and watch its official channels for the actual restart.
Stablecoin issuers froze funds within hours
Tether froze close to $1.57 billion linked to the theft and Circle froze more than $800 million. Ripple froze about $200 million. World Liberty Financial also froze some stolen funds with the custodian BitGo, and Yi He, a Binance co-founder, said that covered $27 million in stablecoins plus roughly $2 million of its own tokens.
Yi He said Binance will cover “all hacking losses”. Changpeng Zhao, who left the top job but remains the largest shareholder, wrote on X that it “does look like a hack” and that he expects customers to be fully reimbursed. Binance also keeps a reserve fund held in bitcoin for this kind of event, according to its website. Binance.US, a separate exchange, said it was not affected.
In an emailed statement to TechCrunch, Binance urged users to be careful with unofficial links, messages and requests for account details. Phishing campaigns usually follow a breach this public.
North Korea blamed
Two blockchain analytics firms, TRM Labs and Chainalysis, attribute the attack to North Korea. TRM says it is highly confident, because the pattern resembles earlier heists tied to Pyongyang, including the 2025 Bybit theft. In its analysis, wallets on 10 different blockchains were hit and most of the money left within about 20 minutes. North Korean diplomats had not replied to requests for comment.
The scale is large: Binance’s 2025 annual report counted 335 million registered users and $162.8 billion held for them. Bitcoin slid more than 3% on the news and Coinbase’s shares dropped 4.8% in US after-hours trading. Binance says it will post updates once its investigators have verified more details.
