The Binance hack explained: How much cryptocurrency was stolen, who’s behind the attack, and was a single compromised laptop to blame?

Binance has confirmed a security breach thought to be the largest crypto heist in history, with more than $6.3 billion (£4.7 billion) stolen by hackers.

In a statement, the crypto exchange firm revealed around half of affected assets have been frozen in response to the incident. A significant portion still remains in the hands of cyber criminals, however, and Binance has pledged to “cover all losses”.

Initial findings from blockchain analytics firm TRM suggests Ethereum accounts for roughly $3.79 billion of the total stolen, with Bitcoin accounting for $1.47 billion.

At $6.3 billion, this makes the Binance hack the single largest cryptocurrency theft in history.

Research from Elliptic noted that this “dwarfs” the $1.46 billion stolen from Bybit during a February 2025 attack, which itself was more than twice that of any previous incident.

Who’s behind the Binance hack?

Cybersecurity researchers have attributed the attack to the TraderTraitor group, a North Korean state-sponsored hacker unit associated with the infamous Lazarus Group.

Rafe Pilling, senior director of threat research at Sophos, said the attack bears all the hallmarks of the TraderTraitor group. Sophos’ Counter-Threat Unit has been tracking the group since 2009 under the name NICKEL ALLEY.

“This incident is still in the initial ‘fog of war’ phase, and Binance will need to take time to fully investigate how this attack happened,” he said.

“Initial reports do align with the playbook of the group known as TraderTraitor, a North Korean state-sponsored cluster associated with previous cryptocurrency thefts,” he said.

TraderTraitor is believed to have been behind the aforementioned attack on Bybit last year. In an advisory shortly after the incident, the FBI attributed the attack to the group.

North Korean hacker groups have frequently targeted cryptocurrency exchanges in recent years, with the Lazarus Group in particular having successfully breached a series of firms.

The aim here is to enable the North Korean regime to circumvent economic sanctions and provide it with a steady flow of cash. It’s a tactic highlighted by security experts as far back as 2017, and one that has clearly proved successful given the steady volume of attacks since then.

How was Binance hacked?

Reports on how TraderTraitor gained access to Binance systems are murky right now, especially given the crypto exchange has changed its tune over the last 24 hours.

Initially, it was believed that the incident stemmed from a single compromised developer workstation – a finding detailed by Binance co-CEO Richard Teng in a post on LinkedIn.

“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he wrote.

“To be clear: the attacker did not simply use one engineer's permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”

According to Pilling, this tracks with previous attacks by the TraderTraitor group, who typically aim to compromise employee devices – particularly those used by developers and engineers with deep access to mission-critical systems.

This enables the threat group to “conduct reconnaissance and develop the technical attack,” he explained. “Then, in a relatively short space of time, they launch the attack using rapid, coordinated transactions to steal cryptocurrency from the victim organization.”

While there is a clear link between the group’s techniques and the initial statement from Binance, the company has since revealed a subsequent probe uncovered “additional points of breach”.

The crypto exchange is yet to provide any additional details on the attack.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them,” the company said in a post on X.

“Staggering in both its scale and potential consequences”

Cybersecurity experts across the globe have weighed in on the Binance hack over the last 24 hours, conveying shock at the scale of the incident.

Jamie Akhtar, CEO and co-founder of CyberSmart, described the incident as “staggering in both its scale and potential consequences”.

“Initial investigations suggest the attack may have begun with a compromised employee laptop, although further points of compromise have since been identified,” he said.

“The fact that cybercriminals were reportedly able to move billions in digital assets in a matter of minutes demonstrates just how devastating a successful attack can be.”

Chris Dimitriadis, chief global strategy officer at ISACA, said incidents such as these “affects trust in cryptocurrency as a whole”. Dimitriadis warned that the incident may prompt further attacks as threat groups look to capitalize on confusion among customers.

“High-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets,” he said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.