Roughly half of $6.3 billion. That is how much Binance says it has managed to freeze after what is now the largest crypto theft on record, a figure that dwarfs the $1.5 billion taken from the Bybit exchange in 2025. The other half, by the company's own account, has not been accounted for. Nobody outside the firm can yet say how much of it is still in an attacker's hands, though analysts say it is a lot.

The Binance hack came to light on Thursday, when the exchange confirmed that client assets had been affected and promised to cover every loss. Bitcoin slid more than 4% on Friday, touching levels around $77,000, and a six-week low appeared in early Asian trading, as the Guardian reported. Ethereum, Solana and other large tokens fell sharply too.

What Binance has said, and what it hasn't

The company's account has shifted since Thursday. Its first explanation pointed to a compromised laptop belonging to a DevOps engineer, which would have let an intruder reach a service container and push through unauthorised withdrawals. Richard Teng, a co-chief executive, then moved to correct the picture. The attacker, he said, had done more than borrow one engineer's permissions, and the job was no single-step trick. A later update conceded that the investigation had turned up additional points of breach.

That is a real retreat from the tidy version. A stolen laptop is a story about one person's bad day; multiple breach points is a story about architecture. Binance has promised a detailed technical post-mortem once the facts are verified, and says it has found no evidence that any wallet private key leaked. It has not said who it thinks did it, and, according to the BBC, it declined to answer directly when asked about North Korea.

The exchange suspended withdrawals while it rebuilds its withdrawal controls and revokes the affected address authorisations. Deposits were left running, which tells you something about priorities. Yi He, the co-founder, indicated that withdrawals could begin returning within 48 hours. Binance.US, the separate and far smaller American platform, said it was untouched.

The attribution to Pyongyang

Two blockchain analytics firms, TRM Labs and Chainalysis, have pinned the theft on TraderTraitor, a North Korean state-linked unit that Check Point says is also known as Lazarus Group. The claim rests on on-chain behaviour in the hours after the theft. There is no confession or arrest behind it, and North Korea has denied involvement in earlier hacks.

TRM listed what it sees as shared fingerprints with the Bybit job and with the KelpDAO exploit in April: small withdrawals through Tornado Cash to fund an operator wallet, preparation that began long before the theft, and signatures gathered in advance and then fired off in one burst. Western agencies have said such proceeds help pay for the regime's weapons programmes. Ari Redbord, TRM's global head of policy, called the episode a watershed and noted that the attacker still holds an enormous sum, so tracing is far from finished.

Why the method of attack matters most

The sharpest line in the coverage came from Check Point's chief information security officer, Jayant Dave, who compared the incident with the Bitget theft of roughly $388 million in September. Attackers, he said, no longer need the vault keys. They go after the systems and the people who are authorised to use them.

For years, exchange security was sold as a question of custody: cold storage, multi-signature schemes, keys split across vaults. The Bybit episode already cracked that story, and this one may break it. If the weak point is the machinery of approving and sending a withdrawal, a company can hold its keys flawlessly and still lose billions. A hardware wallet is no defence against an engineer's laptop that has been quietly owned for months, which is what the staging pattern TRM describes would imply.

It also widens who is exposed. Binance is the biggest exchange in the world, with somewhere above 300 million registered users and, by its 2025 annual report, about $162.8 billion in custody. Eric Jardine of Chainalysis urged every exchange to stay alert, since the sheer value held on these platforms makes them natural targets. Bernardo Brites, chief executive of Trace Finance, went further and argued that AI now finds vulnerabilities faster than defenders can patch them. That is one executive's view, and an unproven one, but insiders are now making such claims out loud.

Stablecoin issuers hit the freeze button

What distinguished this response from older heists was how quickly private issuers moved. Paolo Ardoino, Tether's chief executive, said the company had locked USDT worth upwards of $1.5 billion that could be linked to the breach. Circle's Jeremy Allaire reported more than $800 million of USDC frozen. Ripple said it was freezing RLUSD, and World Liberty Financial, the Trump-linked venture, said it had worked with the custodian BitGo to lock up stolen funds, with Yi He putting that tranche at about $27 million in stablecoins plus some $2 million in World Liberty tokens.

Stablecoin issuers can do this because they control the contracts. Bitcoin cannot be frozen by anyone. It is hard to miss that the most effective recovery tool in this episode was a centralised switch, wielded by a handful of private companies, with no court order described in any of the reporting so far. Crypto's founding promise was that nobody holds such a switch. The industry used it within hours, and few will complain this time. The precedent is another matter.

Regulators see their opening

Speaking to CNBC on Friday, the Commodity Futures Trading Commission's chairman, Michael Selig, argued that the breach bore out his case. On October 5 the agency proposed a framework under which crypto exchanges could register with it, after Congress failed to pass legislation. The core problem, he said, is unregulated offshore exchanges lacking the safeguards found in American markets, and he wants to offer them a federal route with cyber-security obligations attached.

There is a fair counterargument. The Bybit and Bitget victims were hardly regulatory exiles, and a registration regime does not by itself stop a patient state-backed team. The FBI said it knew of the incident and was working with public and private partners to gauge its scope. Binance's own history is awkward here: its founder, Changpeng Zhao, pleaded guilty in 2023 to a US felony tied to anti-money-laundering failures and was pardoned by Donald Trump in 2025. Zhao posted that user funds were safe and that, as a shareholder, he expected them to be fully covered.

What to watch

Three things will settle how bad this is. First, whether Binance reopens withdrawals on schedule, and whether customers actually rush for the door once they can. Second, the post-mortem: if it confirms several independent breach points, every rival exchange will be rewriting its internal access rules. Third, the unfrozen half. Tim Sun of HashKey Group warned that the episode could chill risk appetite and push investors to rethink keeping assets on centralised platforms. Binance's reserve fund, held in bitcoin, can only absorb so much of a loss, and a firm that pays out billions from it will have its own balance sheet read closely for months.