Tether bitcoin holdings are larger than the stablecoin issuer’s own reserve paperwork suggests, according to CEO Paolo Ardoino. Speaking at the Plan ₿ Forum in Lugano, Switzerland, he said the company holds “give or take 150,000 bitcoin,” adding, “It’s not much, but it’s honest work.” At recent prices near $77,600, that stack is worth roughly $11.6 billion.

The number stands out because Tether’s third-quarter reserve report, published October 30 with an attestation from BDO, points to a much smaller position. It lists $8.37 billion in bitcoin, valued at $83,621.23 per coin on September 30. That works out to about 100,060 BTC, leaving a gap of roughly 50,000 coins.

Why the Tether bitcoin holdings figures don’t match

The sources do not describe a fresh 50,000 BTC purchase, and Ardoino gave no acquisition timeline or wallet breakdown. The likelier explanation is structural. Tether has said that investments made from its profits are kept separate from the reserves backing USDT. Coins held by an affiliate such as Tether Investments, which holds the group’s venture and equity positions, would therefore not show up in the attestation. Ardoino did not say which entity owns the extra coins, so that remains an inference rather than a confirmed answer.

Tether has been buying bitcoin since it adopted a policy in May 2023 of putting a portion of its profits into the asset. Its wider exposure also runs through mining and energy ventures in Latin America, a full takeover of Twenty One Capital in May, and backing for Adecoagro’s mining operations in Brazil. Whether any of those positions are counted in the 150,000 figure is unclear.

A bigger cushion, but one tied to volatile assets

The disclosure comes as Tether’s balance sheet leans more heavily on bitcoin and gold. The Q3 report shows $191.45 billion in reserve assets against about $183.50 billion in liabilities, an excess of $7.95 billion. That is up from roughly $4.1 billion at the end of June. Treasury bill exposure remains the backbone at about $132.4 billion, though the direct holdings account for about $122.84 billion of that. Gold, at around $19.1 billion, and the $8.37 billion in bitcoin together exceed the excess several times over, so a sharp fall in either would eat into the buffer.

Most of the bitcoin line’s rise during the quarter reflected price, not buying. Estimates based on the attestation suggest only about 1,130 BTC were added, up from roughly 98,930 at the end of June. Tether also reported about $1.5 billion in net operating profit for the quarter and $4.5 billion over nine months. In August it completed its first independent audit with KPMG, after years of relying on attestations alone.

If the 150,000 figure is accurate, Tether would rank among the largest corporate bitcoin holders. It would still sit far behind Strategy, which held 848,517 BTC as of the third quarter. Ardoino also said USDT has more than 730 million users and adds about 30 million wallets each quarter. He framed the company’s future around an “Independence Stack” covering energy, mining, communications, self-custody wallets and artificial intelligence.

For now, the 150,000 figure is a CEO’s verbal estimate rather than an audited number. Tether has not said whether it will publish a breakdown of coins held outside the reserve. Until it does, the gap between the keynote and the attestation will keep drawing scrutiny from analysts weighing Tether bitcoin holdings against its reserve disclosures.

Explore more on this topic with Vexel Search.

File photo: Paolo Ardoino by Gage Skidmore.jpg by Gage Skidmore, CC BY-SA 3.0, via Wikimedia Commons.

North Korea has flatly denied responsibility for the $6.3 billion Binance hack, setting up a standoff between Pyongyang and Washington over what may be the largest crypto theft on record. The denial came from Kim Yo Jong, sister of leader Kim Jong Un, in a statement carried by the state-run Korean Central News Agency on Tuesday.

The FBI said over the weekend that North Korea was behind the theft of more than $6 billion in virtual assets from the world’s largest crypto exchange. It tied the attack to TraderTraitor, the same actors it blames for the $1.5 billion Bybit hack in February 2025. Kim called that attribution “absurd rhetoric and nothing new” and a “grave political provocation” meant to mislead international opinion.

What Pyongyang said, and what it didn’t prove

Kim accused the FBI of trying to brand North Korea a “cyber criminal state” and of blindly linking the country to every major cybercrime. She also rejected the Bybit attribution. She then went further, suggesting that whoever stands to receive the stolen funds if they are recovered might offer “a clue” about who is behind the theft. That was widely read as a hint that the US itself could be involved. Cointelegraph noted that the statement offered no evidence for the insinuation.

She also said North Korea had “issues to reconsider” in light of what she called US hostility. That is notable because Pyongyang has so far stayed silent on President Donald Trump’s overtures to resume summit diplomacy. Trump himself appeared to hedge on Saturday, suggesting investigators were not yet certain North Korea was involved.

The case investigators are building

The FBI’s view is not the only one. Blockchain intelligence firm TRM Labs attributed the Binance hack to TraderTraitor with “high confidence,” citing both onchain and offchain intelligence. Chainalysis and the independent investigator ZachXBT also linked the theft to North Korean hackers.

TRM pointed to familiar hallmarks: careful advance preparation, the use of Tornado Cash to fund attacker wallets, and the coordinated execution of transaction signatures obtained earlier. It also cautioned that the laundering pattern differed from the one seen after the Bybit heist. ZachXBT reported that funds stolen from Binance and from Bitget were commingled at one address after passing through THORChain. Bitget’s CEO, Gracy Chen, said early findings tied IP addresses to VPN services used “by a certain DPRK group.”

The FBI says its probe found the thieves converting stolen assets mainly into ether. It expects them to try moving the money through decentralized finance and “instant swap services.”

Why Pyongyang is pushing back so quickly

Cybersecurity experts consider North Korean hackers among the most prolific crypto thieves in the world, and say the proceeds help fund weapons programs. North Korea denies those allegations. Elliptic estimates the country has stolen $7.6 billion in crypto this year, more than in any previous year.

Analysts in South Korea said the speed of the response probably reflects fear of consequences. Lim Eul-chul, a professor at Kyungnam University, told Reuters that with sanctions already in place, crypto theft has become one of the regime’s key channels for securing funds. A formal attribution could invite tighter efforts to choke off that revenue.

Binance’s recovery

For Binance, the immediate concern is confidence. Customers withdrew more than $4.6 billion shortly after the exchange resumed operations following last Thursday’s attack. Decrypt reported that Binance said hourly deposits had begun to exceed withdrawals, an early sign that the run on the exchange may be easing.

The dispute is unlikely to be settled soon. Private investigators and the FBI point the same way, while Pyongyang denies everything and offers no evidence for its counter-theory. For now, the Binance hack remains a case where the attribution is strong but contested, and where the stolen funds are still moving.

Explore more on this topic with Vexel Search.

Operators of the open-source payment processor BTCPay Server are being told to update immediately after a wave of hot wallet thefts hit instances running older versions of the software. The project says it has traced the attack vector to version 2.4.1, released July 23, 2026, and earlier, and that it has no credible reports of drained wallets on the latest release, 2.4.7.

The warning came Monday, after the project began receiving theft reports late Sunday UTC. According to BleepingComputer, the maintainer first asked hosting providers to take affected server instances offline as a precaution and advised operators to shut down while the unauthorized Bitcoin and Litecoin payments were investigated. Cointelegraph reported the same sequence: an emergency shutdown request, then a narrower finding once investigators had identified the attack path.

What BTCPay Server has said about the attack

BTCPay Server lets merchants accept Bitcoin and other digital assets straight into wallets they control, without a payment intermediary. That self-hosted design is also what makes the current situation difficult. Each operator is responsible for patching their own server, and a “hot wallet,” meaning one connected to the internet so it can process payments, is only as safe as the software guarding it.

Founder Nicolas Dorier said the attacks did not target public servers. Investigators have been focused on how the attacker was able to log in as an administrator on instances older than version 2.4.2, which shipped August 7. Dorier said early clues pointed to vulnerabilities in those older releases, and the project later confirmed that finding.

The timing is notable. On October 29, the project disclosed a critical vulnerability found using Anthropic’s Frontier OSS scanner and pushed out 2.4.7 as an emergency security update. The sources do not say whether that specific flaw is what attackers exploited. The project’s confirmed position is narrower: the attack vector affects 2.4.1 and earlier, and users on 2.4.7 have not reported drains.

What is still unknown

Much remains unclear. Cointelegraph noted that BTCPay has not disclosed how many operators were affected, how much was stolen, or the technical details of how attackers gained access. The outlet said it asked BTCPay for comment and had not received a reply before publication. BleepingComputer reported that the project is still responding to affected users and still receiving incident reports, so the scale of the hot wallet thefts may grow.

There is also a possible link to an earlier incident. In August, BTCPay restricted remote Lightning access after an attack that used a vulnerability to obtain Lightning Network Daemon credentials and steal funds. Cointelegraph said it is unclear whether the latest attack vector is connected to that episode.

What operators should do now

Anyone running 2.4.1 or older should treat their server as at risk and, per the project’s guidance, take it offline as soon as possible. The fix is to move to 2.4.7. Operators can do this through Server Settings, then Maintenance, then Update. Docker users can log in over SSH, run sudo su -, move into the btcpayserver-docker directory, and run ./btcpay-update.sh.

Users who lost funds are asked to email details and logs to security@btcpayserver.org and to report the losses to local authorities. The project’s message is blunt: keep your server updated.

For merchants who run their own payment infrastructure, the episode is a reminder that self-custody and self-hosting shift security duties onto the operator. When a patch cycle slips by a few months, the consequences can be immediate and irreversible. Until BTCPay publishes more details, the clearest protection against these hot wallet thefts is to be on 2.4.7.

The latest round of tokenized stock objections has pushed the count of companies resisting a planned OKX-ICE trading venue to 50. Twelve more firms, among them Nvidia, Costco and Nike, have objected to having their shares traded there, according to a Decrypt report dated November 2, 2026.

The report describes it as the biggest single wave of objections so far. Nvidia, Costco and Nike are the three names the report highlights, and it says nine other companies also filed objections in the same batch.

What the tokenized stock objections tell us

The detail that matters most is the pattern. A total of 50 objecting companies, with a dozen arriving at once, suggests the pushback is growing rather than fading. The group now includes some of the best-known consumer and technology brands. Nvidia, Nike and Costco are all household names with large shareholder bases, so their objections carry more weight than a handful of obscure filings would.

The venue at the center of the dispute is tied to OKX, a crypto exchange, and ICE. Tokenized stocks are blockchain-based tokens that represent shares in listed companies. The Decrypt piece refers to the planned platform by the abbreviation “TSV.”

What the available reporting does not say

The material available for this article is thin. Beyond the headline figures, the source text is cut off before it explains why the companies objected, what formal process they used, or who receives and weighs those objections. It also does not say whether the objections can block trading, whether the venue has a launch date, or how OKX and ICE have responded.

Readers should therefore treat several questions as open. It is unclear whether the objecting companies share a common concern, such as investor protection, brand control or regulatory status. It is also unclear whether the objections carry legal force or are a signal of opposition. The excerpt does not address any of these points, and none should be assumed.

Why it matters for tokenized equities

Even with those gaps, the numbers show that major issuers are willing to go on record against third-party trading of their shares in tokenized form. For a venue that depends on offering recognizable names, a growing list of objectors from the largest companies is a notable obstacle. Whether it proves decisive will depend on the rules governing the process, which this report does not detail.

Further coverage should clarify the objection mechanism, the stated reasons, and any reply from the venue’s backers. Until then, the clearest facts are that the tally has reached 50 and that Nvidia, Costco and Nike are now on the list.

Hong Kong has moved tokenized settlement onto a round-the-clock footing, and its monetary regulator now wants regulated stablecoins to join the next round of government debt trials. The Hong Kong Monetary Authority (HKMA) announced on Monday, during Hong Kong FinTech Week, that its EnsembleTX pilot now supports 24/7 real-value transactions.

The HKMA says banks and their clients can use the upgraded system to move funds across borders, manage tokenized investments and run treasury operations outside normal settlement hours. Until now, participating banks settled payments through Hong Kong’s existing dollar settlement system, which operates only during set hours. When real-value trials began in November 2025, the regulator said it would eventually add tokenized central bank money to remove that constraint.

Why round-the-clock tokenized settlement matters

Tokenized assets can in theory change hands on networks that never close. The cash needed to pay for them has usually been tied to bank services with limited hours. As one analysis of the announcement put it, that mismatch can leave a buyer or seller waiting, pre-funding an account or accepting exposure to an intermediary while the payment side catches up.

HKMA Chief Executive Eddie Yue described tokenized central bank money as a “foundation layer” for 24/7 settlement, and said tokenized bonds, money market funds and bank deposits are already in use. The practical benefit is easy to picture. A corporate treasury team could rebalance after an overseas market opens instead of holding idle cash until Hong Kong’s banks reopen. That benefit is conditional, though. It depends on participating institutions, eligible instruments and the arrangements behind each transaction, so it does not mean every Hong Kong financial product now trades continuously.

Government debt trials and the stablecoin question

The HKMA also said recognized dealers have completed secondary-market trial trades in tokenized Exchange Fund Bills, the short-term debt the regulator issues. Secondary trading matters because it tests whether a tokenized instrument can keep working as part of a market after its initial sale, including for financing and collateral use.

The next phase will add regulated stablecoins to these trials. That raises questions the pilot has yet to answer. A licensed issuer has defined obligations, but a settlement system still has to decide how to treat that issuer’s liabilities. Participants will want to know who can redeem, how redemption requests are handled outside banking hours, and what happens if an intermediary cannot process a payment. A stablecoin is not the same as central bank money or a commercial bank deposit, and the trials should show how smoothly the different forms of money interact.

HSBC’s RedCoin shows the retail side

While Ensemble targets wholesale and institutional flows, HSBC’s Hong Kong dollar stablecoin points to a retail audience. Group CEO Georges Elhedery said RedCoin reached 50,000 users roughly 10 days after its October 23 launch, and that the bank is aiming for “multi-million users.” The token runs through the PayMe app for transfers and merchant payments, and more than 3.3 million PayMe customers are eligible to activate stablecoin wallets. HSBC also plans to bring it into its mobile banking app and to support subscriptions to tokenized investments, including a Hong Kong dollar money market fund share class.

Elhedery added that HSBC offers tokenized deposits to wholesale clients in Hong Kong and about half a dozen other jurisdictions, letting funds move around the clock. HSBC was one of Hong Kong’s first licensed stablecoin issuers in April, alongside Anchorpoint Financial, a venture backed by Animoca Brands and Standard Chartered. The licensing regime, introduced in August 2025, sets standards for backing reserves, redemption and risk management.

What to watch next

Fifty thousand users in under two weeks is an early signal, not proof of mass adoption, and the Ensemble trials have not yet reported results on settlement failures or costs. Those measures will show whether continuous tokenized settlement makes markets cheaper and more reliable to run or simply faster to confirm. The HKMA used the same event to announce initiatives on AI governance, quantum-resistant security and cross-border payments, which suggests the city is treating tokenization as one part of a broader infrastructure overhaul.

File photo: Hong Kong Harbour Night 2019-06-11.jpg by Benh LIEU SONG (Flickr), CC BY-SA 4.0, via Wikimedia Commons.

The Mercado Bitcoin hack has forced Brazil’s largest cryptocurrency exchange to suspend deposits and withdrawals, and the first reports point to losses in the tens of millions of dollars. The platform paused activity on Monday, November 2, 2026, after a security incident. The scale of the theft is still being pinned down.

What is known about the Mercado Bitcoin hack

The available reporting is thin. Decrypt describes the incident as a $40 million hack, while other accounts put the figure closer to $46 million. That gap suggests the total was still being tallied, or that outlets are counting different assets. The material reviewed does not explain the discrepancy, so the exact loss should be treated as unconfirmed.

What is clear is the operational response. Mercado Bitcoin halted both deposits and withdrawals, a standard emergency step that stops further funds leaving the platform while investigators work out how attackers got in. For customers, it means their balances are temporarily out of reach.

Tether freezes stolen funds

One concrete development is that Tether, the issuer of the USDT stablecoin, froze more than 4.5 million USDT tied to the attack. Stablecoin issuers can blacklist addresses holding their tokens, which makes freezes one of the few tools available for clawing back stolen crypto quickly. The frozen amount is a small share of the reported losses, though, and most of the stolen value presumably sits in other assets that cannot be blocked so easily.

The sources do not say how the attackers breached the exchange, which assets were taken, or whether customer funds were affected directly or covered by the company’s own reserves. They also do not give a timeline for resuming withdrawals. The Decrypt excerpt cuts off just as it begins to relay Mercado Bitcoin’s statement to customers, so the company’s exact wording is not available here.

Why the Mercado Bitcoin hack matters

As the biggest exchange in Brazil, Mercado Bitcoin is a main on-ramp for the country’s retail crypto users. A prolonged freeze would hit a large customer base, and the incident will likely renew scrutiny of custody and security practices at major exchanges in Latin America’s biggest economy.

For now, the key questions are unanswered: the final size of the loss, the cause of the breach, whether users will be made whole, and when normal service returns. This article will need updating as Mercado Bitcoin and security analysts release more detail.

Explore more on this topic with Vexel Search.

Binance withdrawals are coming back online in phases after what is described as the largest cryptocurrency theft on record, a roughly $6.3bn haul that US authorities attribute to North Korean hackers. The exchange began restoring services on Sunday, days after a suspension that followed Thursday’s attack.

What Binance says it has restored

The world’s largest crypto exchange says it has already replaced about 95 percent of the affected assets. In a statement on X, the company said it “will absorb the financial impact of the stolen funds, not our users.” That promise is likely to matter to customers who feared losses from the breach, though the company has not said in the material available how it is covering the shortfall.

The reopening is gradual. Major assets such as Bitcoin and Ether are being restored first, along with some stablecoin services. Binance warned that heavy demand could cause delays, and told customers whose transactions fail to wait briefly and try again. More services will return only as security checks are completed.

The FBI’s attribution to North Korea

On Saturday, the FBI said North Korea was behind the theft and tied it to cyber-activity the agency tracks as TraderTraitor. According to the FBI, investigators have watched the attackers convert stolen assets mainly into ether, the token of the Ethereum network. The agency expects more laundering through decentralised finance platforms and instant crypto exchange services, channels that can make tracing and recovery harder.

The FBI also linked the same actors to the theft of about $1.5bn from the exchange Bybit in February 2025. If both attributions hold, the Binance incident would be a far larger repeat of an earlier pattern of state-linked attacks on crypto platforms.

How the breach happened remains unclear

Binance first suggested that a compromised employee laptop may have given the attackers their way in. It has since said investigators found additional points of breach, which suggests the intrusion was broader than first thought. The company says its investigation is continuing and that it will publish a detailed report once it concludes. Until then, the full technical picture, and any lessons for the wider industry, remain incomplete.

For now, Binance says its teams are working with law enforcement and industry partners to trace and recover the stolen funds. Customers watching for the full return of Binance withdrawals will have to rely on the exchange’s updates as each stage of security checks is finished. The pace of laundering the FBI describes may also determine how much of the stolen money can ever be recovered.

Explore more on this topic with Vexel Search.

Binance says it has replaced 90 percent of the stolen assets from the $6.3 billion hack that hit its platform this week, the largest crypto theft on record. The exchange also says it is on track to reopen customer withdrawals on Sunday, November 1.

The figure was up from 80 percent a day earlier, according to Cointelegraph. The Verge reported that Binance’s CEO has also promised to cover the remaining 10 percent. Binance has framed the pledge as a simple principle: the company, not its users, will absorb the loss.

How Binance is replacing the stolen assets

A Binance spokesperson told Cointelegraph the money is coming from three places: the company’s corporate treasury, a partial deployment of its Secure Asset Fund for Users (SAFU), and a portion of its futures insurance fund. The spokesperson said the insurance fund would stay above required risk-management levels.

Several details remain unstated. The spokesperson did not say how much each source contributed, and did not disclose the insurance fund’s minimum required balance. Binance also did not say how much of the stolen crypto had actually been recovered, as opposed to replaced through purchases.

The final 10 percent is the hardest part. Binance says it consists of “less liquid” tokens, which are harder to buy quickly in large volumes. The company says it is acquiring them through a mix of market and over-the-counter trades, and it has acknowledged this could take longer. By its account, customer balances in Bitcoin, Ether and eight other assets are already fully backed.

What is still unverified

The claims come mainly from Binance itself, and outside verification has lagged. On Friday, Binance said it had set aside $6.34 billion to cover losses, including $5 billion in the affected cryptocurrencies. Security firm CertiK told Cointelegraph that day that it needed more information before it could verify that $5 billion figure.

Binance has since published a new reserves snapshot, but the full cryptographic proof is not ready. The exchange says the zero-knowledge proof takes roughly 40 to 50 hours to generate because of the computational workload. That timing means the complete proof may arrive only around or after the planned reopening of withdrawals.

The attack and the wider response

The theft happened Thursday. TRM Labs has since attributed it to TraderTraitor, a hacking group linked to North Korea. Cointelegraph’s coverage also notes that the FBI and Secret Service have joined the response.

Industry partners also froze some of the loot. Tether and Circle froze about $3 billion in affected assets after the attack, according to Cointelegraph. Those frozen funds are separate from Binance’s replacement of the stolen assets, so they do not count toward the 90 percent figure.

What to watch on Sunday

Binance says it will give a further update once details on the withdrawal reopening are confirmed. It has promised “measurable progress, transparent reporting, and concrete actions.” Sunday’s reopening will be the first real test of that promise. If withdrawals resume smoothly and the zero-knowledge proof backs up the reserve claims, the exchange can argue it contained the damage. If the proof is delayed or shows gaps, scrutiny of how Binance is funding the replacement of the stolen assets will only grow.

Explore more on this topic with Vexel Search.

Binance says it has earmarked more than $6.34 billion of its own money to make customers whole after the largest cryptocurrency theft on record. Independent analysts say they cannot yet confirm that claim. The exchange’s promise to cover Binance hack losses is a bold one, and it now depends on proof that outsiders have not been able to check.

What Binance says it has set aside

According to Binance, the $6.34 billion comes from company funds, and about $5 billion of it is already held in the exact tokens that were stolen. “These assets are in Binance custody,” a spokesperson said. The exchange did not say when it acquired them, and it declined to publish wallet addresses, citing security. It said the holdings will appear in its next proof-of-reserves report, which shows the assets backing customer balances.

Binance has not said which tokens it still needs to buy, when those purchases will finish, or how much of the stolen crypto has been recovered. It did say that roughly $3 billion in affected assets was frozen with help from blockchain partners. That money is not counted in the $6.34 billion.

How the attack unfolded

Binance confirmed the roughly $6.3 billion hack on Friday. The blockchain intelligence firm TRM Labs said funds were drained from Binance wallets across 10 blockchains the day before, and it attributed the attack to the North Korean hacking group TraderTraitor. That attribution comes from TRM Labs, not from a court or from Binance’s own statement in the source reporting.

Analysts want proof before they accept the numbers

Security firm CertiK said it needs more information from Binance before it can judge whether the claimed $5 billion in matching tokens can be verified on-chain. Earlier on Friday, CertiK CEO Ronghui Gu had estimated that the frozen assets plus Binance’s $1.17 billion emergency fund could cover about 66% of the losses. That would leave a gap of around $2.1 billion, which Gu put at about 1.3% of the $165 billion in reserves Binance reports.

Nansen, another analytics firm, said it could not verify what funds Binance had beyond its roughly $1.16 billion emergency fund, or where the money for the remaining losses would come from. Without wallet addresses, the claim rests on Binance’s word until the proof-of-reserves report is published.

Founders point to revenue and other holdings

Binance’s leaders have pointed to the company’s finances. Co-founder Yi He said the exchange’s revenue for the year was enough to cover the losses and that Binance would not need to sell its stake in SpaceX. Changpeng Zhao, who stepped down as CEO in 2023 and later served four months in a US prison over anti-money-laundering violations, said the SpaceX holdings alone are worth more than $1 billion. He added that Binance accumulates the cryptocurrencies it lists because customers can pay trading fees in those tokens. He also said Gulf, Binance’s partner in Thailand, had offered financial support.

Binance said it already sends weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority, and that this requirement predated the hack.

What to watch next

The next proof-of-reserves report is the key test. If it shows the promised tokens in Binance custody, it would back up the company’s claim that customers will not bear the Binance hack losses. If it is delayed or incomplete, the gap between the exchange’s assurances and the independent estimates will stay open. Binance also still has to say which tokens it must buy and how much of the stolen money it can recover.

Explore more on this topic with Vexel Search.

File photo: 5 years birthday Binance cake in Paris – 2022-07-08.jpg by Bretwa, CC BY-SA 4.0, via Wikimedia Commons.

The Binance hack, which Binance puts at roughly $6.3bn (£4.7bn), is believed to be the largest theft in cryptocurrency history. It has sent a jolt through an industry used to security scandals. The exchange says customers will not lose out, but several questions remain open, including who did it and how much of the money can be clawed back.

How the Binance hack unfolded

The first signs came from crypto watchers on X, who noticed large sums leaving wallets linked to Binance. Founder Changpeng Zhao then confirmed a problem. Binance later said its early investigation pointed to a compromised laptop belonging to a DevOps engineer. That access, it said, let an attacker reach a service container and submit unauthorised withdrawals.

Co-chief executive Richard Teng stressed it was not a simple “one-click” break-in. He later said more than one person was involved, and that the attackers used sophisticated methods to cover their tracks, including a “self-destruct mechanism”. Security experts quoted by the BBC suggested an engineer may have been tricked into running something like a test, allowing malware onto a machine with enough privileges to act as a direct route into production systems and then to the wallets. As one cybersecurity executive put it, a vault is only as safe as the people holding the keys.

Only Binance’s main global exchange, Binance.com, was affected. Binance.us, which serves US residents, says it was not.

What was taken

Estimates circulating online ranged from $2bn to $8bn before Binance settled on its $6.3bn figure, and the final tally could take days to establish. Early reports, cited by Fortune, say about $1.5bn was in Bitcoin and a similar amount in the Tether stablecoin. Slightly under $1bn was reportedly in Ethereum and the USDC stablecoin, with other tokens likely taken as well.

Who is behind the Binance hack?

Nobody has claimed responsibility, and Binance has not named a culprit. Some analytics firms, including TRM Labs, have pointed towards North Korea. They say elements of the attack resemble earlier incidents, such as the $1.5bn ByBit theft in 2025, which was linked to the Lazarus Group, also known as TraderTraitor. Fortune reports that TRM and others consider North Korea almost certainly responsible, but both outlets stress there is no definitive proof.

The theory is plausible. Oxford academic Dr Edward Howell told the BBC that Pyongyang has a long record of using cyber operations to raise cash, and estimated that 40-50% of its weapons programmes are funded this way. North Korea has consistently denied involvement in such attacks, and Binance has not directly addressed the possible link.

Is my money safe?

Binance says user funds are safe. It temporarily suspended deposits and withdrawals as a precaution. It says it will cover all losses from an emergency reserve built for such events, topped up with company money if needed. Fortune notes that rivals, including Coinbase and Tether, pledged support. Markets appear to have taken that reassurance on board: Bitcoin and Ethereum fell around 3%, a dip that coincided with a broader market sell-off.

Recovery is another matter. Binance says it is working with partners to freeze stolen assets and that about $3bn has reportedly been located. Tether and Circle, which issue USDT and USDC, said they would freeze stablecoins tied to the theft. But Fortune reports evidence that the hacker quickly deposited stolen funds on the lending platform Aave as collateral for an Ethereum loan. If so, the thief could walk away with the borrowed Ethereum even if the collateral is frozen, so freezes may only be partly effective.

What users should do now

Experts advise checking balances only through the official Binance app or a web address you already trust. Crisis moments like this are prime time for scammers, so the warning signs include:

• emails claiming your funds are at risk;
• fake support accounts offering help;
• messages urging you to move your crypto to a “safe” wallet.

Never share passwords, verification codes or wallet recovery phrases, and avoid links in unsolicited messages.

The bigger picture

The incident lands on a company that has faced scrutiny before. Zhao resigned as chief executive in 2023 after pleading guilty to money laundering violations, and a US lawsuit last year accused the firm of helping send money to designated terrorist groups. Binance said in 2024 that it held more than $160bn in assets, which helps explain why it can promise to absorb the loss.

Some people online have questioned how one compromised laptop could open the door to billions. Binance promised fuller details soon, and the answers will matter for confidence in the exchange.

Explore more on this topic with Vexel Search.

File photo: 5 years birthday Binance cake in Paris – 2022-07-08.jpg by Bretwa, CC BY-SA 4.0, via Wikimedia Commons.