Binance Faces $6.3B Hack After DevOps Laptop Breach

The problem first surfaced on Thursday evening. By Friday morning the estimated impact had passed $6 billion, and Binance temporarily suspended deposits and withdrawals across its platforms.

A Promise to Cover Every Loss

Co-CEO Richard Teng told users, Your money is safe, and we’re covering every loss. Binance says it has set aside more than $6.3 billion from its own funds to make users whole. About $5 billion of that is already held in the affected token assets, and the exchange is buying the rest through various channels.

Recovery is also under way. Binance says it is working with law enforcement and partners to trace, freeze, and recover more funds, and it has already frozen around $3 billion in assets. It remains on track towards the expected timeline to restore withdrawals within 45 hours, while the investigation keeps turning up new details about the breach.

Blockchain intelligence firm TRM Labs notes that several elements of the attack resemble earlier North Korean-linked incidents, including the 2025 Bybit hack, which cost $1.5 billion. Groups such as TraderTraitor are often blamed for thefts of this sophistication.

The market reacted quickly. Bitcoin slipped 5% after the attack, and other crypto platforms tightened their own defenses, a common response when a major hack lands. Binance controls an estimated 35 to 36 percent of the total crypto market, which raises the stakes. It also arrives with baggage: in November 2023 the company pleaded guilty to anti-money laundering and sanctions violations and paid a $4.3 billion settlement to the US Department of Justice, and founder Changpeng Zhao stepped down as CEO and was sentenced to prison.

What Users Should Watch For

Experts expect phishing to spike in the wake of the breach. Marijus Briedis, chief technology officer at NordVPN, urges users to stay on guard:

• Verify any update through the official Binance app or a trusted web address
• Avoid links in unsolicited messages
• Never share passwords or recovery phrases

The UK FCA adds that most crypto activity in the country is unregulated, that crypto is highly volatile and exposed to cyber attacks, and that investors should be prepared to lose all their money.

Hashlytics Take

The entry point is the real story. A DevOps laptop usually carries privileged access to infrastructure, so one compromised endpoint can reach far beyond one person’s files, and that is a people-and-devices failure rather than a flaw in any blockchain. Binance’s “funds are safe” line is also a statement about its balance sheet, not its security: it can pay because it holds roughly $6.3 billion in reserves, which few exchanges could say. The harder signal is the admission of additional breach points. Until Binance can say how far the intrusion reached, the 45-hour withdrawal target is the number to watch, and the North Korea link should be read as a resemblance flagged by TRM Labs, not a confirmed attribution.