The crypto market woke up to a nasty jolt on Friday after Binance confirmed it had been hit by a security breach that, by its own estimate, touched around $6.3 billion in assets. If that figure holds, it would comfortably surpass the roughly $1.5 billion Bybit heist of February 2025, which had been regarded as the industry’s biggest single theft.
Prices reacted fast. By 6am UAE time, Bitcoin had shed 4.5 per cent over 24 hours to $76,664, while Ether dropped 5.2 per cent to $2,190. Binance’s own BNB token took the heaviest hit, sliding 7.1 per cent to $698.65. Some of that damage was clawed back within a couple of hours, with Bitcoin trading near $77,984 shortly before 8am, Ether at $2,230 and BNB at $716.69, all still in the red for the day.
Leverage made things uglier. More than $1.5 billion in leveraged positions were wiped out in a single day, and most of them were bullish bets, a reminder of how quickly overconfident long positions get flushed when bad news lands.
The attribution is the part that should worry everyone. Blockchain intelligence firm TRM Labs has tied the attack with high confidence to TraderTraitor, a North Korean hacking group. Pyongyang-linked actors were also blamed for the Bybit breach, and the pattern is hard to ignore: state-backed groups are going after the largest pools of liquidity in crypto and succeeding. Estimates of the haul still vary, with Chainalysis putting the stolen amount nearer $5.9 billion at the time of the attack.
There is some damage control. Roughly $3 billion has reportedly been frozen, including more than $2.3 billion in stablecoins, which shows how much centralised issuers can do when they move quickly. Co-chief executive Yi He says Binance will cover all user losses. That is a significant promise, though it rests on the exchange’s own assurance for now. Binance holds about $144 billion in assets under custody, which gives it room to absorb the hit, and some analysts argue BNB’s decline has been surprisingly restrained given the scale of the incident.
Customers, however, are still locked out. Deposits and withdrawals remain suspended, and there is no public timeline for when they will resume.
Adding to the jitters, prediction market Polymarket briefly paused trading on Thursday after users reported unauthorised withdrawals tied to a compromised third-party provider. Nothing so far connects the two incidents.
The question now is less about Binance’s balance sheet and more about the industry’s security model. If the world’s biggest exchange can lose billions to a known adversary, every platform holding pooled user funds should be asking what it is doing differently.
