A $6.3 billion hacking incident at the world’s largest cryptocurrency exchange, Binance, has sent shockwaves around the world.

It is the biggest theft in cryptocurrency history. The amount is more than 4 times the $1.5 billion stolen in a hack of Bybit in February 2025.

Binance has halted deposits and withdrawals and said it would make customers whole, but questions persist over whether it can really absorb the loss.

The New York Times and the Wall Street Journal (WSJ) reported the incident began around 4:20 p.m. local time on the 29th. They said abnormal transactions were detected as billions of dollars’ worth of coins flowed out of a large hot wallet where Binance pools and stores customer coins.

The attacker used a valid signature approval to make Binance’s hot wallet execute code the attacker deployed. Funds then moved out across multiple blockchains in transactions that appeared to carry normal signatures. The New York Times likened it to a bank robbery carried out in an instant over the internet.

Blockchain analytics firms Chainalysis and TRM Labs pointed to North Korea’s elite hacking group, TraderTraitor, as being behind the attack. Binance has not identified the attacker. Binance is cooperating with the FBI and the U.S. Secret Service.

After the hack, Binance executives set up an emergency war room in an internal messenger with about 100 participants, including security staff and fund-tracing specialists. Co-CEO He Yi (허이), who is seven months pregnant, also stayed up overnight in Abu Dhabi and joined a 3 a.m. call. Withdrawals are expected to resume within 2 days after security checks are completed.

Binance worked with crypto-related companies to freeze some of the stolen funds. Some coins managed directly by issuers can be frozen even if they sit in a hacker wallet, preventing laundering and theft before funds are moved out.

Through these steps, stablecoin issuers Tether and Circle froze about $3 billion. World Liberty Financial, a crypto company tied to the family of U.S. President Donald Trump, also froze $27 million worth of its stablecoin, USD1.

Even so, the attacker still holds cryptocurrencies worth $3.3 billion. Tracking them is also becoming increasingly difficult. Hackers are repeatedly moving funds among multiple wallets to disrupt tracing.

Attention is now focused on whether Binance has the capacity to absorb the damage.

Binance has operated an emergency fund called SAFU for such incidents. But as of the day of the incident, the bitcoin held in SAFU amounted to only $1.23 billion. The WSJ reported that the value fell by another $100 million as bitcoin prices dropped after the hack.

The company says it will cover any shortfall with its own funds.

Binance has separately secured more than $6.3 billion, including SAFU. Of that amount, $5 billion is held in the same types of coins that were stolen this time.

Binance is buying the remaining $1.3 billion worth of coins in the market, which could take more time. The WSJ reported Binance plans to cover losses with company money first, then refill its coffers with the $3 billion that was frozen once it is released.

By the numbers, the damage from the incident is not beyond what Binance can absorb. According to blockchain analytics firm Nansen, cryptocurrencies held in Binance wallets total $167 billion. But those holdings include customer funds, and the New York Times reported the size of actual reserves has never been disclosed.

Binance’s revenue model is trading fees. The company processed trades worth $34 trillion last year. He Yi said, "We can cover the loss with this year’s revenue alone."

The incident appears to have delivered a stronger psychological shock because it occurred amid a string of AI-related hacks.

How the hackers breached defenses is still not clear. Binance said an initial investigation found indications that one engineer’s laptop was compromised, and later discovered additional points of intrusion. The New York Times reported that in February 2025, Bybit also lost $1.5 billion worth of cryptocurrency in an attack believed to be backed by North Korea, after approving what looked like an ordinary transaction that gave hackers access to internal systems.

Chainalysis said the hackers employed a money-laundering pattern it had not seen before, and likely used automated tools given the volume of thousands of transactions in a short period. In a video posted on social media platform X (Twitter), He Yi said the spread of AI had become an industry-wide threat and added, "We should have invested in security earlier and more."

Moody’s Vice President Cristiano Ventricelli said, "This incident showed a structure in which risk is concentrated in large centralized intermediaries," and added, "The larger the assets under custody, the bigger the shock a single hack can bring."