Summary
The attack on Binance, estimated at around $6.3 billion, is the largest cryptocurrency theft ever recorded: approximately four times that suffered by Bybit in February 2025 (around $1.5 billion; see our In-depth Analysis of 24 February 2025).
The two cases share the same attributed perpetrator – a North Korean unit known as TraderTraitor – and the point of entry: a developer’s computer. However, they differ in the composition of the haul and, above all, in their crisis management. Bybit kept withdrawals open and relied on loans from competitors; Binance suspended withdrawals for around three days, gradually reopening them on Sunday 1 November and covering the losses with its own funds.
The attack on Binance
Binance suspended all withdrawals following a theft estimated at around 6.3 billion dollars. Around $3 billion, mainly stablecoins, were frozen; the remainder was converted by the hackers into unseizable tokens such as ETH.
Method. According to the company’s preliminary investigation, the attackers compromised an in-house engineer’s laptop. Further points of compromise subsequently came to light. Binance states that users’ private keys have not been compromised.
Attribution. TRM Labs links the attack to TraderTraitor, a North Korean unit. On Saturday 31 October, the FBI confirmed this attribution – the same one previously made for the theft at Bybit – and anticipates that the funds will be further converted and laundered.
Response. Binance has committed to reimbursing all customers whose assets were stolen. It has already set aside a reserve equivalent to 95 per cent of the stolen funds, financed from its own revenues and an emergency fund. The remaining 5 per cent consists of less liquid tokens, which the company is purchasing on the market and which take longer to source in large quantities.
Reopening. On Sunday 1 November, Binance began a gradual resumption of withdrawals, one network and one asset at a time, with stability and security checks carried out before each reopening. It started with ETH, USDT and USDC on the Ethereum blockchain and with certain assets on the BNB Smart Chain; later that evening, dogecoin and solana, amongst others, were added. Priority is being given to the tokens in highest demand over the past week, and delays may occur due to high traffic.
Outflows. In the first nine and a half hours following the reopening, the platform processed 4.65 billion in withdrawals and 1.01 billion in deposits. Net outflows totalled 3.64 billion, equivalent to 2.1 per cent of the assets held on the day before the attack.
Security. Co-CEO Richard Teng announced the rebuilding and retesting of the entire infrastructure, as well as a comprehensive security review across the company. Binance will publish a report on the investigation, conducted in collaboration with law enforcement agencies and blockchain analytics firms.
Freezes. Tether has frozen approximately 1.5 billion in USDT and Circle 800 million in USDC. Elliptic has verified 2.8 billion in frozen funds.
Market. Bitcoin fell by around 4 per cent following the news, before rebounding above $78,000. The sector was already in a prolonged downtrend.
The previous incident: Bybit, February 2025
On 21 February 2025, North Korean hackers stole over 400,000 ETH and stETH – worth approximately 1.5 billion dollars – from Bybit via a single multi-signature cold wallet. Until the attack on Binance, this was the largest crypto theft in history.
Method. It was a supply-chain attack: it was not Bybit that was breached, but Safe{Wallet}, the provider of the multi-signature wallet. The hackers compromised a Safe developer’s computer and replaced a JavaScript file in the interface with malicious code, which was active only on Bybit transactions. The signatories approved what appeared to be a routine transfer, which instead handed control of the wallet to the attackers. Safe’s smart contract was never compromised.
Response. Bybit did not suspend withdrawals, despite facing spikes in requests amounting to nearly 100 times the normal volume. Within a few hours, it secured bridge loans totalling approximately 80 per cent of the lost ETH and chose not to buy ETH on the market. Among the assistance received was a loan of 40,000 ETH from Bitget, interest-free and unsecured, which was repaid within three days. By 24 February, it had received 1.23 billion in ETH through loans, deposits from major investors and over-the-counter purchases, plugging the gap. An audit by Hacken subsequently confirmed its reserves were above 100 per cent.
Comparison
Same perpetrator and same vulnerability, but very different scale, haul and response.
Scale and systemic risk. Binance is the world’s largest exchange, with around 140 billion in assets under custody, and the attack came at a time when the market was already in decline. Bybit was a smaller operator; indeed, in 2025, Binance was among the exchanges that helped it restore liquidity. Upon reopening, net outflows stood at 2.1 per cent of assets: a figure which, at least in the early hours, did not indicate a widespread exodus.
Impact of asset type. The difference in the scale of the freezes depends on the type of asset. Stablecoin issuers can freeze their own tokens, something that is impossible with ETH. This is why, in the Binance case, almost half the amount was frozen, whilst in the Bybit case, almost nothing was.
Regulatory context. Binance has a troubled history: a 4.3 billion fine in the US in 2023, its exit from the EU in July due to a lack of a licence, and its exclusion from the UK since 2021. It is now regulated in Abu Dhabi, where the regulatory authority is closely monitoring the case.
Conclusions and outstanding issues
The two attacks confirm that North Korea is targeting the workstations of individual developers, either within the exchange or at its suppliers’ premises. The Binance case is much larger but has been partly contained by the freezing of stablecoins. The responses have been opposite: Bybit focused on maintaining withdrawal services and seeking help from competitors, whilst Binance opted for a temporary shutdown and relied on its own reserves. Sunday’s reopening, with limited outflows and refunds already 95 per cent covered, marks a first step towards normality.
Some questions remain unanswered:
- • Will outflows remain limited once all assets are withdrawable again?
- • How long will it take to purchase the 5 per cent of illiquid tokens still needed to cover the refunds?
- • What will the report promised by Binance on further security breaches reveal?
- • How many of the approximately 3.3 billion converted into unfrozen assets will be traced or recovered?
Sources
- • Financial Times, “Binance halts withdrawals after record $6.3bn heist”
- • Financial Times, “Binance users pull $3.6bn as crypto exchange restarts services after heist”
- • BleepingComputer: Lazarus struck Bybit via a compromised Safe {Wallet}
- • Reflectiz: anatomy of the attack on Bybit
- • Bybit: official timeline of the incident
- • DL News: Bybit’s bridge loan
- • Nansen Research: Bybit’s response and fund flows
- • CNBC via NBC: replenished reserves and Hacken audit
- • Today in the Markets: repayment of Bitget’s loan
Disclaimer
This post reflects the personal opinions of the Custodia Wealth Management staff who drafted it. It does not constitute investment advice or recommendations, nor does it constitute personalised advice, and should not be regarded as an invitation to carry out transactions in financial instruments.
