Binance hack: $6.3 billion crypto theft explained

It started quietly, the way most of these things do. Somewhere inside Binance’s systems, an engineer’s laptop had already been compromised. Nobody at the world’s biggest cryptocurrency exchange knew it yet. By the time the dust settled, Binance says assets worth $6.3 billion had been affected, one of the largest crypto thefts ever recorded.

If you follow global tech and finance news, you’ll know this isn’t Binance’s first brush with trouble. Readers who followed our coverage of how a handful of firms now dominate the US market will recognise the pattern: a handful of giant platforms, each holding enormous amounts of money and data, each a tempting target.

What actually happened

Binance is the largest cryptocurrency trading platform in the world by volume, with a reported 335 million users. For comparison, Crypto.com has estimated there are around 741 million crypto owners worldwide, which gives you a sense of just how big a slice of the market Binance holds.

On this occasion, Binance said on X that its investigation points to a “compromised” laptop used by one of its engineers, along with other “points of breach.” In plain terms, someone got into a system they shouldn’t have, and from there found a way into funds worth billions of dollars.

Cryptocurrencies run on a technology called blockchain, a digital ledger that records every transaction and is built to be very hard to fake. Moving crypto requires a “private key,” a long, secret string of characters that acts like a password with no reset button. The theory behind crypto security is sound. The practice, as this case shows, still depends on humans, laptops and software that can all be attacked.

“Even when you think you are using one of the most robust exchanges in the world, it can still be hacked,” Stephane Ifrah, an analyst at Coinhouse, told AFP.

How do hackers even get in?

There’s more than one way in. Hackers can exploit a weakness in software, sneak in malicious code, or go after a person directly through phishing, tricking someone into handing over access without realising it.

Even hardware wallets, physical devices that store private keys offline and away from the internet, aren’t fully safe. Users of the French company Ledger had funds stolen in the past after malicious parts were secretly added to devices sold through a third-party retailer. The lesson is that no single layer of security is enough on its own.

Who is behind the Binance hack?

Binance hasn’t officially confirmed who carried out the attack. But three well-known analyst firms, TRM Labs, Chainalysis and Elliptic, have pointed to hackers linked to North Korea, specifically a group known as TraderTraitor or the Lazarus Group.

To put the scale in context, the amount reportedly stolen from Binance is around four times what the same hackers took from the Bybit exchange in February 2025, according to the FBI. That earlier theft, $1.5 billion, was at the time the largest cryptocurrency heist ever recorded. This new figure from Binance appears to have gone well beyond it.

Elliptic and Chainalysis also say some of the funds taken from Binance have been traced to the same pool of assets as money stolen in a recent hack of the platform Bitget, which Bitget itself blamed on Pyongyang.

Can any of the stolen money be recovered?

Binance says it has frozen about $3 billion of the affected crypto, nearly half the total, with help from issuers and infrastructure partners. But freezing funds isn’t the same as getting them back.

Stephane Ifrah warns that attackers can use anonymising tools known as “mixers” or “tumblers,” which are designed to scramble the trail of stolen crypto and make it much harder to trace. Binance has said it will cover the losses from the hack itself, which should reassure affected users, but it doesn’t undo the breach. As Ifrah put it, “it is clear that there is no such thing as zero risk.”

What this means if you’re in Kuwait

Crypto trading isn’t officially regulated as an investment product in Kuwait, but plenty of residents, both Kuwaiti citizens and expats, still trade or hold crypto through international platforms like Binance. This breach doesn’t mean every user lost money. Binance has said it will cover losses, and a large share of the affected funds has already been frozen. But it’s a clear signal that even the biggest, most established exchange in the world can be breached through something as simple as one compromised laptop.

If you hold crypto on any exchange, now is a reasonable time to review your account security: enable two-factor authentication, avoid reusing passwords, and be alert to phishing messages pretending to be from your exchange. If you use a hardware wallet, only buy it directly from the manufacturer, not from a random third-party seller, given what happened with Ledger devices in the past.

Binance has also had a rocky few years beyond this hack. Its former CEO, Changpeng Zhao, was convicted in the United States in 2024 for violating anti-money laundering laws, though he was later pardoned by President Donald Trump. The company has also faced accusations in the US of selling assets that count as unregistered securities, and in France it’s suspected of failing to properly oversee client funds. It also failed to get authorisation under the European Union’s MiCA crypto rules, and recently announced a partial suspension of its operations within the EU.

You can follow our wider international news coverage for more on how global tech and finance stories like this one ripple outward. None of this means crypto is worthless or that every exchange is unsafe. It does mean that the risk is real, ongoing, and worth taking seriously if your savings are involved.

Quick answers