Binance, the world’s largest cryptocurrency exchange, has confirmed a cyber-attack that it says affected assets worth about $6.3bn. It is, by a wide margin, the largest theft in the history of the industry — the previous record, a $1.5bn raid on the Bybit exchange in 2025, was less than a quarter of the size.
The company says roughly $3bn of the stolen assets have already been frozen on-chain, that it has set aside more than $6.34bn of its own funds to cover the losses, and that customer balances are unaffected. Deposits and withdrawals were briefly suspended and then restored.
How they got in
Binance’s first account was narrow: a DevOps engineer’s laptop had been compromised, which let the attackers reach a service container and submit unauthorised withdrawal transactions. The company said there was no evidence that wallet private keys or passwords had leaked.
That account did not hold. Co-chief executive Richard Teng later said the investigation had “uncovered additional points of breach”, that it “was not carried out by one person”, and that the attackers ran a self-destruct mechanism which destroyed their tooling and traces as they went. Analysts believe the intruders got as far as the machinery that authorises payments out of a hot wallet — the internet-connected wallet an exchange uses for day-to-day movement — and rewired it so that funds were forwarded to them without anyone approving each one.
Why $3bn could be stopped and the rest could not
This is the part worth understanding, because it is the only real lever anyone had.
Some of what was taken was stablecoins — tokens pegged to the dollar and issued by a company. Tether’s chief executive Paolo Ardoino said more than $1.5bn linked to the hack had been frozen; Circle’s Jeremy Allaire said more than $800m. Both can do that because a stablecoin is, in the end, a ledger entry an issuer controls. They can blacklist an address, and the tokens in it stop moving.
Bitcoin has no such switch. Nobody issues it and nobody can freeze it, which is exactly the property its holders value and exactly why it is what thieves convert into. Tracing it is possible — and firms like TRM Labs and Chainalysis do — but tracing is not stopping.
So the frozen half of this theft is a measure of how much of “crypto” now runs on instruments with a central operator, and the unfrozen half is a measure of how much does not.
What it means here
Buying and selling cryptocurrency has no legal standing here. The central bank began cautioning against it in 2014 and has repeated that position since; the enforcement instrument is the Foreign Exchange Regulation Act, under which taking value out of the country this way is an offence rather than a trade.
That does not mean nobody here holds it. A sizeable informal market runs on peer-to-peer transfers, often settled through mobile financial services, and a good deal of freelancing income has been parked in stablecoins to avoid the remittance system. The people doing that should read this story carefully for one reason: there is no recourse. Binance is covering its customers’ losses because it chose to and can afford to. A Bangladeshi holder whose account is drained has no regulator to complain to, because the activity the regulator would be protecting is the activity it has prohibited.
American federal investigators have since joined the effort to trace and recover the money, and several analytics firms have linked the attack to a North Korean unit — both developments covered separately as they firmed up.
