Binance’s $6.3 billion hack dwarfs Bybit's $ 1.5 billion breach: Is cryptocurrency theft getting bigger?

There have been several significant attacks in the cryptocurrency space over the past years. However, the latest one that is being reported as an alleged $6.3 billion theft from Binance has taken everything to a whole new level. The attack is considerably bigger than the previously known biggest cyberattack, the theft of about $1.5 billion from Bybit in February 2025. The magnitude of this particular attack has once again brought into question the ability of crypto exchanges to ensure the safety of assets placed on their platforms despite all security measures.

According to Binance, the world's biggest cryptocurrency exchange by trading volume, the hacking compromised digital assets worth about $6.3 billion.

Initially, the company stated that part of the assets was frozen, and part was still under the control of the attackers. Binance promised to compensate for the losses. As reported by the BBC, investigators suspect that the hack could become the biggest cryptocurrency theft ever.


Also Read | US Midterms 2026: Why Trump's Republican rivals may be helping Democrats win Senate seats

The FBI has blamed the cyberattack on TraderTraitor, a hacking organisation that is believed to be backed by North Korea. Blockchain analytics companies have also spotted certain similarities between the attack on Binance and previously recorded cyberattacks that were carried out by North Korean cybercriminals.

North Korea has repeatedly denied its responsibility in previous cyberattacks; hence, attribution in this kind of situation is based on technical facts rather than statements.

The incident has once again raised a rather unpleasant question: do the security systems of cryptocurrencies keep up with their growing monetary value?

Binance’s losses put the Bybit record into perspective

The February 2025 hack of Bybit marked a milestone in securing cryptocurrencies. Hackers managed to steal around $1.5 billion worth of digital currency from the exchange during an Ethereum transfer. The sum exceeded other large-scale hacks of cryptocurrencies and led to closer examination of how the exchanges secure wallets and approve transactions.

According to The AP, Bybit assured its customers that it would fulfil its obligations regardless of the inability to recover the stolen funds.

Also Read | US midterm elections 2026: Inside the $11.6 billion money war for Senate control as battleground races heat up

The estimate of the total damage caused by the hack at Binance ($6.3 billion) is almost four times the size of the Bybit hack.

It should be noted, however, that the numbers have to be considered carefully. The Binance estimate is about the number of assets affected by the hack, and the financial damage might turn out to be different after further investigation.

According to the BBC, while Binance initially suspected the breach could have come through an engineer’s computer, the company later found other possible points of entry.

According to the exchange, the incident was more complicated than merely misusing someone’s access, and at that time there were no indications that the wallet keys had been stolen.

Also Read | Florida Learjet 60 crash: What investigators will look for in the jet's final flight data

The exact vector used to carry out the attack remains one of the key questions investigators need to answer.

The relevance of comparing the two cases is that they indicate a possible shift towards targeting transaction authorisation systems rather than stealing regular wallet keys.

Some security specialists note the similarities between the attacks; however, the mere presence of such similarities is not enough to claim that the perpetrators are the same.

Why major cryptocurrency exchanges remain attractive targets

There is great potential in attacking large exchanges since they accumulate a large quantity of digital assets and carry out transactions in several blockchain networks. The attack itself can bring an attacker millions or even billions of dollars in terms of profit, which makes it lucrative despite being complex.

The case of Binance Exchange shows why security goes beyond ensuring private keys are kept offline.

Also Read | Russia once dismissed a US terror warning before the deadly Crocus massacre. Now, Moscow has arrested a teenager after a fresh American tip-off. What changed?

Large exchanges operate through interconnected systems, access permissions and transaction signing in order to transfer assets. In case the attackers succeed in breaching the system used for withdrawal authorisation, they will not need to use the wallet's private key.

According to Reuters, the main Binance hack took place within 20 minutes, based on data from the blockchain and cybersecurity experts. As soon as the hack started, the attackers acted fast; in the meantime, the exchange and its allies tried to locate the hacked funds and block them.

The link to North Korea makes things even more interesting.

In the past, US government agencies and blockchain analysis firms have made connections between cyber activities conducted by North Korea and crypto thefts. The West has, in the past, asserted that these funds were going towards financing the weapon development programs of the country. However, tracing the money flow in detail can be problematic.

According to the BBC report, security experts found some resemblance between the Binance hack and the previous hacks conducted by North Korean-related hacker groups.

From an exchange point of view, the key takeaway is that ensuring the safety of their digital assets entails more than just securing their wallets.

Frozen assets and customer withdrawals will test confidence in crypto

Consequences of cryptocurrency hack may become even more difficult than the process of hacking.

In contrast to regular bank transfer operations, cryptocurrency transactions cannot be easily cancelled by requesting the system to undo the transaction. Recovery requires locating the money, cooperation of the exchanges and, in some cases, intervention of the issuers of certain digital currencies.

As a result of the Binance hack, the company tried to collaborate with cryptocurrency firms and freeze the money. According to the BBC, Binance was able to locate or freeze part of the stolen money, but not all of it yet. The company assured that the losses will be covered by using the company’s resources and protection scheme.

It is not obvious that freezing money means automatic recovery of funds by their rightful owner.

There are cryptocurrencies with issuers which can control particular tokens, while other cryptocurrencies can be transferred into different wallets or systems. It should be found out where the money was moved and whether there is an opportunity to get back these funds.

Behavior of customers is also one of the factors of consequences.

Binance briefly froze withdrawals while it evaluated the security of its operations and then reopened them. Reuters reports that as of November 2, customers withdrew a net total of $4.72 billion following the reopening of withdrawal services, although Binance noted that outflows were beginning to level off and money was flowing into its services too.

These outflows do not necessarily mean that Binance is insolvent or that it has lost its customers forever. They do, however, illustrate just how rapidly a major security breach can make users question their choice of exchange for holding their digital currencies.

The Binance and Bybit hacks have revealed a major vulnerability in the world of cryptocurrencies: While bigger exchanges offer deeper liquidity and a range of services, they also represent an attractive target for hackers since they store large amounts of assets.

It remains to be seen whether hacking cryptocurrency exchanges is becoming increasingly common or just getting more expensive.

One thing, however, is certain – the cost of a single successful hack has become significantly higher. For cryptocurrency exchanges, the issue is no longer about avoiding attacks but about detecting them promptly, containing any possible losses, and protecting customers in case of a security failure.