Binance, the world's largest cryptocurrency exchange, has revealed that it was subjected to a hack that resulted in the theft of approximately $6.36 billion in digital assets. The company attributed this massive breach to attackers gaining access to a mobile device belonging to a DevOps engineer, which allowed them to access a "service container" and execute unauthorized withdrawal transactions.
Richard Teng, CEO of Binance, explained that the attack was not merely the use of a single engineer's credentials or a simple "one-click" operation, but rather a highly complex process. The company confirmed that, as of now, there is no evidence of private keys being leaked, noting that it has discovered "additional points of compromise" and is still gathering facts.
Accusations Against North Korean-Backed Groups
Although Binance has not officially named a specific entity, specialized data analysis firms such as TRM Labs and Chainalysis have attributed the attack to the "TraderTraitor" group, a state-sponsored hacking unit in North Korea also known as "Lazarus Group" or "APT38".
According to TRM Labs, the funds were moved across ten different blockchains in just 20 minutes, making it the largest theft in cryptocurrency history, exceeding the Bybit exchange hack that occurred in February 2025 by four times.
What Does This Incident Change in the Security Landscape?
This breach goes beyond being a massive financial loss, as it revealed technical and behavioral vulnerabilities in rapid response mechanisms:
- Bypassing Asset Freezes: Although stablecoin issuers like Tether, Circle, and Ripple successfully froze approximately $2.7 billion, the attackers managed to retain about $2.4 billion by selling stablecoins to market makers and borrowing Ethereum (ETH) against them via the Aave protocol, which placed these funds outside the direct control of the issuers.
- High-Speed Execution: The attackers' exploitation of speed in moving assets across multiple chains made it difficult for regulatory and technical bodies to catch up with them before the assets were converted into forms that are difficult to track.
- Targeting Developer Infrastructure: The incident highlights the danger of targeting DevOps engineers' devices, as access to container environments represents a key to controlling sensitive operations and bypassing traditional security controls.
User Status and Compensation
Binance has reassured its users that their funds are safe, confirming that it will cover all losses from the Secure Asset Fund for Users (SAFU) and the company's own funds. The exchange has temporarily suspended deposits and withdrawals to conduct comprehensive security checks and is working with blockchain intelligence partners and law enforcement agencies to recover the remaining funds.