The Binance hack explained: How much cryptocurrency was stolen, who’s behind the attack, and was a single compromised laptop to blame? - IT Pro

In a statement, the crypto exchange firm revealed around half of affected assets have been frozen in response to the incident. A significant portion still remains in the hands of cyber criminals, however, and Binance has pledged to "cover all losses".

Initial findings from blockchain analytics firm TRM suggests Ethereum accounts for roughly $3.79 billion of the total stolen, with Bitcoin accounting for $1.47 billion.

At $6.3 billion, this makes the Binance hack the single largest cryptocurrency theft in history. Research from Elliptic noted that this "dwarfs" the $1.46 billion stolen from Bybit during a February 2025 attack, which itself was more than twice that of any previous incident.

North Korean hackers blamed

Cybersecurity researchers have attributed the attack to the TraderTraitor group, a North Korean state-sponsored hacker unit associated with the infamous Lazarus Group.

TraderTraitor is believed to have been behind the aforementioned attack on Bybit last year. In an advisory shortly after the incident, the FBI attributed the attack to the group.

North Korean hacker groups have frequently targeted cryptocurrency exchanges in recent years, with the Lazarus Group in particular having successfully breached a series of firms. The aim here is to enable the North Korean regime to circumvent economic sanctions and provide it with a steady flow of cash.

Attack method revealed

Reports on how TraderTraitor gained access to Binance systems are murky right now, especially given the crypto exchange has changed its tune over the last 24 hours.

Initially, it was believed that the incident stemmed from a single compromised developer workstation – a finding detailed by Binance co-CEO Richard Teng in a post on LinkedIn.

According to Pilling, this tracks with previous attacks by the TraderTraitor group, who typically aim to compromise employee devices – particularly those used by developers and engineers with deep access to mission-critical systems.

While there is a clear link between the group's techniques and the initial statement from Binance, the company has since revealed a subsequent probe uncovered "additional points of breach". The crypto exchange is yet to provide any additional details on the attack.

Industry reacts

Cybersecurity experts across the globe have weighed in on the Binance hack over the last 24 hours, conveying shock at the scale of the incident.

Chris Dimitriadis, chief global strategy officer at ISACA, said incidents such as these "affects trust in cryptocurrency as a whole". Dimitriadis warned that the incident may prompt further attacks as threat groups look to capitalize on confusion among customers.

"High-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets," he said.