By Elena Vasquez

Binance will absorb the full estimated $6.3 billion impact of a cyberattack on its exchange, the company said, adding that customer holdings remain secure.

It will draw on the SAFU emergency fund and its own corporate money rather than shift the shortfall to customers. That makes the balance sheet, not customer balances, the immediate source of protection for the full estimated exposure.

Is this the biggest crypto theft on record?

The Wall Street Journal reported that the heist may be the biggest in history. The previous record came in 2025, when crypto exchange Bybit lost $1.5 billion to hackers tied to North Korea; the $6.3 billion Binance estimate is more than four times that amount.

The designation remains provisional because The Wall Street Journal described the heist as one that “may be the biggest in history,” while Binance has yet to publish its detailed findings.

What did investigators find?

According to Binance’s initial investigation, an attacker compromised a DevOps engineer’s laptop, reached a service container and pushed through withdrawals that had never been approved.

The exchange said its review had found nothing to suggest that a wallet’s private keys had leaked. On the account given, the immediate route ran through a developer’s laptop and infrastructure access, rather than disclosed theft of wallet keys.

A follow-up Binance statement on X said further investigation had found additional places where attackers breached the exchange, according to The Wall Street Journal. That wider finding leaves both the final loss estimate and the remediation perimeter open.

How is Binance containing the loss?

Binance said it had frozen about $3 billion on-chain with blockchain partners. That sum covers less than half of the $6.3 billion estimate, and the company described the assets as frozen rather than recovered.

It halted withdrawals pending the completion of security reviews and cancelled the authorization tied to the compromised address. Deposits remained untouched and continued to work normally, the company said.

The company plans to publish a detailed technical post-mortem and an updated Proof of Reserves once remediation is complete. Binance also said it is coordinating with police and blockchain analytics partners to track down and retrieve the money and establish who the criminals are.

Who is responsible?

Cybersecurity firms TRM Labs and Pangolin Intelligence said the Binance heist appears to bear the hallmarks of North Korea’s TraderTraitor hacking group, according to The Wall Street Journal. “This was absolutely North Korea,” TRM Labs senior investigator Nick Carlsen told the publication.

The firms’ assessment supplied the attribution, while Binance’s public account focused on the attack mechanics, customer protection and recovery. That leaves two central questions open: the full extent of the breach and whether frozen assets can be returned to affected customers.

How are markets and peers responding?

Bitcoin fell more than 4% on Friday to $77,994.96.

The attack followed a hack at another exchange last month. Bitget lost about $351.6 million in digital assets in September, and its CEO said preliminary evidence pointed to North Korean hackers.

Bitget said its User Protection Fund, valued at more than $464 million, would absorb the loss. The reserve exceeded the reported theft by more than $100 million, compared with the much larger exposure Binance has placed on its SAFU fund and corporate cash.

At $6.3 billion, the Binance estimate is nearly 18 times Bitget’s loss and more than four times Bybit’s 2025 theft. Those comparisons make the withdrawal halt and roughly $3 billion asset freeze interim measures rather than a final resolution of the financial and security exposure.

What remains unresolved?

The immediate financial burden falls on Binance, but the next disclosures will determine the final cost: the exchange still must finish remediation, quantify any additional exposure and publish a detailed technical post-mortem alongside an updated Proof of Reserves.