In what is being called the biggest hack in cryptocurrency history, Binance, the world's largest exchange, has lost approximately €5.6 billion ($6.3 billion) in digital assets. The attack, which unfolded over just under four hours on Thursday night, has drawn the attention of cybersecurity firms and law enforcement across Europe and beyond, with strong indications pointing to a North Korean state-sponsored hacking group.
The scale of the theft dwarfs previous record breaches. For context, the February 2025 Bybit hack, which the FBI attributed to the same North Korean group, involved €1.39 billion. The Poly Network and Ronin Network incidents were even smaller, at €545 million and €482 million respectively. Binance, which controls roughly 35% of the global crypto market, serves as a critical infrastructure for the digital asset ecosystem, making this breach particularly alarming for investors and regulators alike.
Timeline of the attack
The incident began on Thursday evening, when Binance first acknowledged reports of a potential security issue. By 23:15 CET, the company had initiated security checks and suspended withdrawals. Within hours, it became clear that assets were affected. At 01:13 CET, Binance issued a statement promising to cover all losses, and by 03:25 CET, it revealed the full extent: around €5.6 billion had been siphoned from 17 of its hot wallets—wallets that remain online to process withdrawals.
Blockchain data firm Bitquery reported that the unauthorized transactions were signed by Binance's own withdrawal system, indicating a deep compromise. The attacker moved funds across nine blockchains, with Ethereum, Bitcoin, and TRON hit hardest. Stablecoin issuers, including Tether and Circle, managed to freeze approximately €2.4 billion, but the attacker had already swapped €729 million into other assets, leaving roughly €3.1 billion still in their control.
How did they get in?
Binance's initial investigation suggests that the entry point may have been a compromised DevOps engineer's laptop. This allowed the attacker to access a service container and submit unauthorized withdrawal transactions. However, the company later clarified that the attack was "complex" and involved multiple factors, not just the single laptop. Binance has stated that there is no evidence of any private key leakage, and it has revoked affected address authorizations.
The company is working with law enforcement and blockchain intelligence partners to trace and recover the funds. It has also promised to publish a detailed technical post-mortem once the investigation is complete, along with an updated Proof of Reserves.
Who is responsible?
Cybersecurity firm TRM Labs has pointed the finger at TraderTraitor, a North Korean hacking group. "Based on robust on- and off-chain intelligence, we make this judgment with high confidence," the company said in a statement. The same group was named by the FBI as the perpetrator of the Bybit hack in February 2025, which saw €1.39 billion stolen. This latest incident is part of a worrying trend of increasingly sophisticated cyberattacks, with experts noting the growing use of artificial intelligence to identify vulnerabilities.
For European investors and regulators, this hack underscores the fragility of the crypto ecosystem. While Binance has pledged to cover all losses, the incident raises questions about the security of centralized exchanges and the need for stricter oversight. As the investigation continues, the crypto community watches closely, hoping that the frozen funds can be recovered and that lessons will be learned to prevent a repeat of this historic breach.
