The quick take:
- Hackers drained about $6.3 billion from Binance, the world’s largest crypto exchange, in the biggest crypto theft on record.
- Binance’s early investigation points to one compromised engineer’s laptop, and blockchain analysts link the attack to North Korea.
- Why it matters now: the same playbook, one trusted device and one approval that looks legitimate, hits ordinary businesses every day. The numbers are just smaller.
Late Thursday, money started leaving Binance. By blockchain analytics firm TRM Labs’ count, most of it was gone within about 20 minutes.
The total: about $6.3 billion, the largest crypto theft on record. The previous record, the $1.5 billion stolen from the exchange Bybit in February 2025, looks small next to it.
Binance has about 335 million users. And according to its own early investigation, the whole thing may have started with one laptop.
It was not one click
In a statement, Binance co-CEO Richard Teng said the incident “may have started with a compromised DevOps engineer’s laptop.” (DevOps engineers are the people who keep a company’s systems running and updated, which means they have a lot of access.)
From there, the attacker reached an internal service and pushed through withdrawals that looked authorized. Binance says it has found no evidence that its wallet passwords, known as private keys, leaked.
Teng was careful about the details: “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” A follow-up review found “additional points of breach.”
The attacker also cleaned up on the way out. “The attacker also used a self-destruct mechanism that destroyed tooling and tracers,” Teng said, according to Yahoo Finance.
Who did it? Blockchain analysis firms TRM Labs, Elliptic and Chainalysis link the theft to TraderTraitor, a North Korean hacking group also tied to the Bybit heist. That is the researchers’ call. No government has formally named a culprit yet.
Half of it is frozen. That is not the same as getting it back.
Some of the stolen money was in stablecoins, digital tokens pegged to the dollar and issued by companies that can freeze them. Those companies moved fast. Tether froze more than $1.5 billion, Circle froze $800 million, and Binance says about $3 billion is now frozen on-chain.
But frozen is not recovered. Getting it back requires a separate legal process, TRM’s Ari Redbord noted. And the attacker has been swapping stablecoins into bitcoin and ether, which no company can freeze.
Investors sold first
On Friday, bitcoin fell about 5.5% to roughly $76,000. Binance’s own coin, BNB, fell more than 6%. Ether dropped about 4%.
Stocks took it harder. Coinbase fell about 14% and Robinhood about 9%, even though Coinbase said its platform was not affected.
Translation: when the biggest player in an industry gets robbed, customers of every player in that industry start checking their accounts.
How the CEO handled it
Teng took over as CEO in late 2023, after founder Changpeng Zhao pleaded guilty and Binance agreed to pay about $4.3 billion to settle with U.S. authorities. Trust was already the company’s weak spot.
So far, his crisis playbook has been textbook:
Binance posted this video message from Teng after the attack:
- He disclosed it fast. Binance confirmed the attack within about a day.
- He made customers whole, in writing. “We are committed to covering all hacked losses through our company funds. Your assets are safe.”
- He shut the door and said why. Withdrawals were paused. “We are rebuilding the withdrawal service, and we are not switching it back until it passes rigorous testing.” Binance expects them back by Sunday.
- He did not throw the engineer under the bus. “Our investigation has not attributed responsibility to any individual.”
So was it Binance’s fault?
It is too early for a final verdict. Binance has promised a detailed technical account once investigators confirm the facts.
But the break-in happened inside Binance’s systems, so the responsibility for security is Binance’s. And security experts say the flaw is a familiar one.
“A device is not a person,” Frances Zelazny of the identity firm Prove told IBTimes. “An employee’s legitimate device can be compromised.” Her point: a system can confirm that a trusted device approved a transaction without confirming the approval was legitimate.
Read that again. The vault was locked. The thief just had a trusted employee’s key.
Your business has the same problem, just smaller
Most owners will never hold $6 billion in crypto. But almost every business has a laptop, an email inbox and a way to send money.
Americans reported $20.88 billion in cybercrime losses to the FBI in 2025, and phishing and spoofing was the most common complaint. The small-business version of the Binance heist looks like this: one employee’s email gets compromised, a vendor’s bank details quietly change, and a wire goes out that looked completely normal.
Require two people to move money. No single login, including yours, should be able to send a payment alone.
Give access by job, not by title. The attacker at Binance went beyond one engineer’s permissions. Limit what any one account can reach.
Verify payment changes by phone. Use a number you already have, never the one in the email asking for the change.
Know your freeze button. Binance got half its money frozen because partners moved within hours. Do you know your bank’s fraud line by heart?
Write your Teng statement now. Decide in advance who tells customers, what you will promise, and that you will not blame one employee in public.
Binance thinks it started with one laptop.
Every business has one.
Before Your Next Meeting
- If one employee’s email or laptop were compromised tonight, how much money could leave before anyone noticed?
- Can any single person in our business send a payment without a second approval?
- If we had to tell customers about a breach tomorrow, who would say it, and what would we promise?
