What happened
On Friday, Binance said a security incident affected roughly 6.3 billion dollars of client assets and about 3 billion dollars was frozen on chain, setting a new record as the biggest hack in the crypto industry. The company said it has begun clawing back assets linked to the breach and pledged to make customers whole using its Secure Asset Fund for Users, created in 2018 as an insurance-like pool for user protection if a hack occurs.
Early statements suggested the breach might have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." According to Co-CEO Richard Teng, the intrusion turned out to be more intricate than a lone engineer's permissions being abused. Binance added, "We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."
The response and who may be behind it
Binance temporarily halted withdrawals while it upgrades withdrawal security and revoked authorizations for affected addresses, according to Teng. Deposits remained unaffected, co-founder Yi He said, and the company said withdrawals could start coming back online in the next 48 hours. The exchange said it is collaborating with law enforcement and blockchain analytics/intelligence companies to track and recoup the stolen assets. The announcement came after multiple crypto companies had already moved to lock down funds linked to the breach.
On Friday, the FBI said it was aware of what happened and was coordinating with "relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps." Attribution remains uncertain. TRM Labs - an investigations outfit focused on blockchain intelligence and AI - said North Korean hackers were likely responsible, writing, "Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst."
Chainalysis said this appears to "be the work of North Korean cybercrime group TraderTraitor. This group has repeatedly targeted the cryptocurrency industry, exchanges, DeFi protocols, and investors, to raise funds for the regime. We base our intelligence assessment on on-chain activity observed in the hours following the hack."
Smart investors look for new tools that help manage risk and uncover opportunities. We're hosting our first ever investor livestream on 11/17 to show you how to use ChatGPT and Claude to invest like a pro, hosted by Briefs Finance CEO Jaspreet Singh. Save your seat.
Several firms moved to block suspect assets. According to Circle CEO Jeremy Allaire on Thursday evening, the company had locked down in excess of 800 million worth of USD Coin tied to the incident. On X, Tether CEO Paolo Ardoino said the firm took action to freeze over 1.5 billion units of its stablecoin, potentially connected to a breach. Jack McDonald, Ripple's executive overseeing stablecoins, said the company was actively placing holds on impacted RLUSD funds, its U.S. dollar-backed stablecoin.
Markets and the regulatory angle
Bitcoin slid more than 4 percent to 77,187.60 dollars on Friday, with the hack pressuring crypto markets. Security exploits are not rare in crypto. In 2025, Bybit suffered roughly 1.5 billion dollars in losses due to a hack, and more recently Bitget incurred losses exceeding 350 million dollars due to a cyber theft. In recent years, malicious actors have siphoned off billions of dollars from decentralized exchanges.
"This week's breach proves our exact point in proposing regulations for crypto markets earlier this month," CFTC Chairman Michael Selig said Friday on CNBC. On Oct. 5, the U.S. derivatives regulator unveiled a framework that would, in practical terms, place crypto exchanges under federal oversight after Congress failed to pass legislation to regulate the asset. "The real issue here is that these are unregulated offshore exchanges, and they don't have the same sorts of safeguards that we have in our financial markets here in the United States. We want to offer a federal option to these exchanges to come and register with the CFTC, and they would be subject to the same sorts of cyber security safeguards that we have in our markets today," he said.
What this means for your portfolio
In plain English: a top venue paused withdrawals and prices moved lower, with Bitcoin at 77,187.60 dollars. Binance says deposits stayed open and it will use its Secure Asset Fund for Users while working with authorities and intelligence firms to trace and recover assets. The bottom line: continued operational risk at centralized platforms and fresh momentum for tighter exchange oversight.
Learning how technology reshapes markets can give investors a subtle but lasting advantage. On 11/17, our CEO Jaspreet Singh goes live for our first ever investor livestream on how to use ChatGPT and Claude to invest like a pro. Register to join him.
