The most expensive crypto heist on record may have begun with a single engineer’s laptop. That is the uncomfortable detail buried in Binance’s own account of the attack, and it says more about modern security failures than the headline number does.
Binance was hit by a cyber attack with an estimated $6.3 billion in losses, according to Engadget, which cited reporting from The New York Times. If the figure holds, it easily beats the $1.5 billion Bybit hack last year. Binance says it has worked with blockchain partners to freeze about $3 billion on-chain. Tether and Circle say they have frozen $1.5 billion and $800 million respectively in funds tied to the attack.
The company has promised to cover all losses from its SAFU fund and its own money, and says user funds are safe. Maybe. But withdrawals are suspended “for a security revamp,” while deposits remain normal. Read that again. The exchange will happily take your money in, and won’t let it out. Users can’t verify any of this independently, and a reserve fund is only as good as the audit behind it.
The technical explanation is also thin. Binance says its initial investigation suggests a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions. So this wasn’t a clever break of cryptography. It looks like an endpoint compromise that led to access with far too much power. Questions follow. Why could one machine reach a service able to push withdrawals? Where was the review step for large transfers?
Blockchain analytics firm TRM Labs blames TraderTraitor, North Korea’s elite hacking unit, with “high confidence.” That fits a pattern. State-backed groups have turned crypto theft into a revenue stream, and they favor social engineering and developer compromise over exotic exploits. The Bybit theft followed a similar route. Attribution from a vendor that sells tracking tools is worth noting, but the pattern is consistent.
For ordinary users, the lesson is the old one that keeps getting ignored. Funds on a centralized exchange are an IOU, not your assets. HashKey Group’s Tim Sun told Reuters the hack may prompt investors to reassess counterparty, solvency and liquidity risks on such platforms. He’s right. Self-custody has its own risks, but it removes the single point of failure that one stolen laptop just exposed.
There’s also a political angle that deserves scrutiny. Founder Changpeng Zhao pleaded guilty in 2023 to a felony over failing to prevent money laundering, then was pardoned by Donald Trump in 2025. Binance also has a business relationship with the Trump family crypto venture, World Liberty Financial. With regulators now watching a record theft, expect hard questions about how much oversight this company really faces.