Binance recovers 90% of the $6 billion stolen in hacker attack

In the largest recorded cyberattack, over six billion dollars were withdrawn from the cryptocurrency exchange Binance. American agencies are working with private partners to assess the hack and recover the stolen funds, while Binance has promised to cover all losses.

The Federal Bureau of Investigation (FBI) is aware of the incident and is coordinating with partners to understand the scope of the activity, assess potential consequences, and organize appropriate investigative steps, as the agency stated in a message to Bloomberg News on Friday. A representative reported that FBI agents from the Secret Service are also collaborating around the clock with the private sector to recover the stolen assets.

The Department of Justice acknowledged receiving information about the attack, but representatives declined to comment on the progress of the investigation. Although the full details of the Binance hack have not yet been disclosed, this incident occurs amid growing concerns about the risks posed by hackers in the age of artificial intelligence.

Recent cyberattacks have affected the Polymarket prediction platform, South Korean financial companies Mirae Asset Global Investments Co. and Daishin Securities, as well as the Japanese currency trading platform GMO Internet Group Inc.

The largest cryptocurrency trading platform suspended withdrawals and committed to compensating for all losses. Binance co-founder Richard Teng stated in a video posted on social media on Friday that the exchange is capable of doing so due to continuous reinvestment of revenue into cryptocurrencies. Co-founder Yi He clarified that Binance's annual revenue would fully cover the lost amount. Withdrawals were expected to resume by Sunday.

Teng noted: 'Most of what we earn from daily operations is held in crypto assets. That is why we can immediately absorb a loss of this size using our own funds.'

Americans are prohibited from using this exchange; there is a separate, smaller entity, Binance.US.

This hack occurred during a period when the Trump administration and its regulators were actively promoting the widespread adoption of cryptocurrencies and blockchain technology. In September, the Securities and Exchange Commission approved a so-called innovation exemption that allows public company stocks to trade on blockchains. Experts believe that the Binance hack will likely intensify concerns among public company executives regarding the adoption of such technologies.

In turn, the Commodity Futures Trading Commission recently proposed regulations for digital asset markets and transactions. If approved, this measure will regulate leveraged futures trading offered to retail clients and create a new category for crypto exchanges offering such trades, requiring registration with the agency.

Austin Campbell, a cryptocurrency expert and former banker who is now an adjunct professor at NYU Stern School of Business, compared the situation to car safety, stating that 'transactions need delays and checkpoints.' He added: 'A car can be faster, cheaper, and more economical if you remove all the airbags and seatbelts.'

Blockchain analysis firms TRM Labs, Chainalysis, and Elliptic pointed to North Korea as the organization behind the theft from Binance. Chainalysis classified the incident as 'the largest in crypto history and one of the biggest financial crimes of all time.' The funds seized during the attack consisted of a mix of major cryptocurrencies, including Bitcoin, Ethereum, as well as dollar-backed stablecoins USDT and USDC.

Following the news of the attack on Binance, Bitcoin fell below $77,000 for the first time in over a month, remaining the largest traded currency near these low levels for most of Friday.

For cryptocurrency supporters who had enjoyed a two-month price recovery, the Binance incident overshadowed this rally.

Binance significantly surpasses its industry competitors, boasting assets worth approximately $135.2 billion compared to $28.6 billion held by the second-largest exchange, OKX, according to DefiLlama data.

Binance reported that the incident might be related to a compromised engineer's laptop, as well as 'additional points of entry.' The exchange stated that it found no evidence of leaked private keys.

In a post on X, Binance stated: 'It was a sophisticated attack, and we are doing everything possible in coordination with law enforcement to resolve it.'

In 2018, the exchange established an emergency insurance and reserve fund for users called the Secure Asset Fund for Users (SAFU), which serves as a guarantee for clients in 'extreme situations.' According to the exchange's report, SAFU is typically maintained at around $1 billion, but in 2024, it fluctuated in tandem with market movements.

The two largest stablecoin issuers announced measures to freeze the affected currencies. Paolo Ardoino, CEO of Tether, stated in an X post that he froze over $1.5 billion of USDT stablecoin 'related to the potential Binance exchange hack.' Jeremy Allaire, managing director of Circle Internet Group Inc., stated that $800 million of his USDC token was frozen amid 'reports of a possible exploit related to Binance.'

The world's largest cryptocurrency exchange, Binance, was the victim of the sector's largest hacker attack, resulting in the theft of $6.3 billion (approximately R$ 34 billion) on Thursday, the 29th.

Micaella Ribeiro, co-founder of IAM Brasil and an expert in Information Security and Identity and Access Management, commented that this incident demonstrates a significant shift in the landscape of digital threats during an interview with Olhar Digital.

The platform, used for trading and custody of cryptocurrencies such as Bitcoin, suffered the attack around 5 PM Brasília time, and the process lasted about twenty minutes, according to analysis of transaction records by specialists.

Companies specializing in cryptocurrency tracking, such as TRM Labs and Chainalysis, pointed out that those responsible for the theft were hackers associated with North Korea. Although Binance had not yet identified the criminals at the time of publication, the company began recovering the affected assets for users.

Binance publicly declared that it would cover the losses using its own funds, reserving more than $6.34 billion to cover the incident. Of these amounts, $5 billion is already in impacted token assets, and the purchase of the remainder is being made through market and OTC channels, although this process may take longer due to the liquidity of some tokens.

Currently, $3 billion has been blocked with the help of industry partners, and the exchange continues to work with law enforcement agencies, including the FBI and the U.S. Secret Service, to recover these funds.

The company temporarily suspended withdrawals, assuring that customer money is safe and promising to cover any losses. So far, about $3 billion in stolen cryptocurrencies have been located, part of which has been blocked by other companies in the segment.

Initially, Binance suspected that the attack occurred through the intrusion into one of its engineers' computers. Later, the company disclosed that it had identified security vulnerabilities that could have been exploited by cybercriminals. According to TRM Labs, the hackers managed to compromise the system responsible for authorizing cryptocurrency transfers.

Part of the amount stolen was in stablecoins, which function as a reflection of real fiat currencies, such as the US dollar. Several entities blocked resources: Tether froze a little over $1.5 billion; Circle blocked more than $800 million; and Ripple retained about $200 million.

Additionally, Reuters reported that World Liberty Financial, a cryptocurrency company linked to U.S. President Donald Trump and his family, also collaborated in blocking these resources, which prevents the movement of the stolen cryptocurrencies.

Founded in 2017 in Shanghai, China, Binance has 335 million registered global users, according to its 2025 annual report. This report indicated that the company managed approximately $162.8 billion in digital assets.

Micaella Ribeiro emphasizes that an attack on an exchange does not necessarily imply that blockchain technology has been compromised, but stresses the inherent risks of using cryptocurrencies. She differentiates between the security of blockchain technology and the security of the platforms used to buy, sell, and store these assets.

According to the expert, this attack underscores an alarming trend: criminals are focusing on compromising identities, devices, and systems that already hold valid permissions to perform crucial operations. This increases concern about non-human identities, such as APIs, applications, and service accounts, which often have high privileges without the same level of governance given to conventional users.

For Ribeiro, the primary lesson is that a technically authorized operation is not always a legitimate operation. Therefore, she advocates that organizations need to change their security strategy, going beyond protecting initial access, requiring continuous verification of who accesses, what privileges they have, and whether the actions are consistent with their responsibilities.

Regarding investors, the expert advises that the most important thing is to follow the official communications of the exchange, monitor any movement restrictions, and increase vigilance against fraud that may arise from the repercussions of the incident.

Binance, the world's largest cryptocurrency platform, announced on Thursday the freezing of $3 billion in crypto assets during an investigation into a potential security breach. Consequently, related assets belonging to stablecoin issuers Circle and Tether were also frozen.

Binance co-founder Yi He stated that 'Binance will cover all losses from the hack,' but provided no further details about the incident. The impact of this potential hack, which the analytics firm Chainalysis considers potentially the largest crypto heist in history, was immediately felt during early trading in Asia on Friday.

As a result of the incident, Bitcoin dropped by approximately 2%, reaching a six-week low of $77,646, while Ethereum fell about 2% to a two-month low of $2,238.76. The BNB token, originally launched as Binance Coin for paying Binance fees, lost over 8% in the last 24 hours, settling at $694, according to the market aggregator CoinGecko. The cryptocurrency exchange Coinbase Global slipped by 4.8%, and the Bitcoin buyer exchange Strategy fell nearly 6% during extended trading in the US.

Binance clarified that the amount of frozen funds may increase as the company collaborates with law enforcement agencies, token issuers, blockchain analytics firms, and other industry partners to track and block additional assets. Binance co-founder Changpeng Zhao, who no longer leads the company, stated in an X post that the incident 'resembles a hack.'

Binance, which allows users to buy, sell, and trade digital assets, has over 335 million registered users worldwide and held approximately $160 billion in assets under custody as of its 2024 annual report.

Binance Maintains a Protected Asset Fund

According to the Binance website, the exchange manages a protected asset fund for users. This reserve consists entirely of Bitcoin and is intended to safeguard user assets in the event of security breaches. Bernardo Brites, CEO of Trace Finance, a company specializing in payment and stablecoin infrastructure, noted that 'it is becoming very difficult to resist hacks because AI can find vulnerabilities faster than you can fix them.' He added that he believes users will start leaving smaller and medium-sized exchanges because 'it is too risky to keep your money where they cannot cover a significant hack.'

Tether reported freezing assets related to the incident worth nearly $1.57 billion, while Circle froze over $800 million. Binance stated that it is conducting security checks and will resume withdrawals after the issue is fully resolved, emphasizing that user funds remain safe while teams investigate the incident. As a precautionary measure, the exchange also temporarily suspended trading on its Binance Alpha platform.

World Liberty Financial, a crypto company associated with US President Donald Trump and his family, announced on Thursday that it had cooperated with cryptocurrency custodian BitGo to freeze funds stolen in what they termed the Binance hack. According to Yi from Binance, $27 million in stablecoins and about $2 million in World Liberty Financial tokens were frozen. Additionally, the crypto firm Ripple froze approximately $200 million in funds. Jack McDonald, Vice President of Stablecoins at Ripple, stated that the company is closely monitoring reports of a possible exploit related to Binance and is freezing affected funds while coordinating with relevant parties.

Incident Adds to String of Crypto Heists

Miguel Morel, CEO of blockchain analytics firm Arkham, reported that data suggests billions of dollars may have been stolen from Binance by an unknown perpetrator, although the exact cause has not yet been confirmed. Morel noted that the incident began around 4:30 PM EDT (8:30 PM GMT) and apparently continued. This case joins a series of crypto heists. According to researchers at TRM Labs, attackers stole $2.9 billion in cryptocurrency in almost 150 attacks last year. In September, the cryptocurrency exchange Bitget reported a theft of approximately $350 million from its platform, highlighting the industry's vulnerability to hackers.

Authorities warn that organized crime groups are increasingly using cryptocurrencies for cross-border fund transfers outside the traditional financial system. Binance.US, a separate cryptocurrency exchange, stated that it was not affected by the security incident. Coinbase also stated that it was unaffected and is monitoring the situation. In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily suspended trading following a security incident involving a third-party provider but later resumed trading and promised to fully compensate affected traders.