Binance, the world’s largest cryptocurrency exchange, has suffered the biggest crypto heist ever recorded. Thieves made off with roughly $5.6 billion in digital assets, forcing the company to freeze withdrawals while it investigates. Binance insists “user funds remain safe” and has promised to cover every dollar lost, but the sheer size of the theft puts that promise to a real test.
What was taken
According to Binance’s preliminary breakdown, the stolen funds span a wide mix of assets: about $1.57 billion in Tether (USDT), $1.45 billion in Bitcoin, $875 million in Ethereum, $823 million in USD Coin (USDC), $234 million in Tron, $88.5 million in Ripple’s RLUSD, $75 million in Wrapped Beacon Ethereum, $50 million in Tether Gold, and roughly $447.5 million spread across other tokens. The hackers reportedly drained three of Binance’s hot wallets, known as Binance 14, Binance 16, and Hot Wallet 34, which pool customer funds for everyday transactions. Binance hasn’t said exactly how the attackers got in, only that it now believes multiple points of breach were involved after initially suspecting a single compromised laptop.
Billions frozen, but not recovered
The stablecoin issuers behind USDT, USDC, and RLUSD moved quickly to blacklist the thieves’ wallet address in their smart contracts, effectively freezing around $2.4 billion of the stolen total. It’s unclear whether Tether Gold will get the same treatment. Freezing isn’t the same as recovering: those funds are locked in place, and returning them to Binance or affected users typically requires lengthy legal proceedings and proof of ownership. The remaining roughly $3.2 billion sitting in Bitcoin, Ethereum and similar assets is in a much shakier position, since those networks have no central authority that can simply reverse a transaction. Exchanges may be able to block the thieves when they try to cash out, but that kind of after-the-fact defense has a poor track record historically.
Fingers point to North Korea
Security firm TRM has attributed the attack to TraderTraitor, a hacking unit linked to North Korea, citing on-chain and off-chain evidence along with similarities to past incidents. TraderTraitor has previously been blamed for the $1.5 billion theft from the Bybit exchange in February 2025, most of which was never recovered. A separate analyst at Pangolin Intelligence reportedly reached the same conclusion after reviewing on-chain activity tied to the new heist. North Korean state-linked groups have a long history of targeting crypto platforms as a way to generate revenue outside the traditional financial system, and this latest case fits that pattern closely.
Can Binance really cover $5.6 billion?
Binance has a dedicated insurance reserve called SAFU, built since 2018 from 10% of the exchange’s trading fees and held in a cold wallet. That fund currently holds about 15,000 Bitcoin, worth roughly $1.17 billion at current prices, which Binance has used before: it fully covered a 7,000 Bitcoin theft back in 2019. But $1.17 billion is a fraction of a $5.6 billion hole. Former CEO and co-founder Changpeng Zhao has publicly said he expects users to be made whole, which would likely require Binance to dip into other corporate resources beyond SAFU. For now, the exchange’s word is the main guarantee users have, and the final shape of any payout plan hasn’t been detailed.
Watch out for scams
Binance is warning customers to expect a wave of phishing attempts referencing the hack, including fake “compensation” or “withdrawal restoration” offers sent by email, text, or phone. The advice is the same as with any major breach: never click links in unsolicited messages, and only interact with Binance through its official site or app.
The bottom line
This heist is more than twice the size of the previous record-holder, the $1.5 billion Bybit hack, and most of that earlier haul was never recovered. Binance’s promise to cover losses is reassuring, but its SAFU fund alone can’t cover the gap, and the frozen stablecoins still need to work through a legal process before anyone sees them again. If you hold crypto on any centralized exchange, this is a reminder that custody matters: funds in a hot wallet are only as safe as the exchange’s security, and self-custody options exist precisely for situations like this one.
Source: Tom's Hardware
Where to buy
As an Amazon Associate I earn from qualifying purchases.
