Binance lost roughly $6.3 billion, and the failure looks like one signing system that a single compromised laptop may have been able to reach.
TRM Labs puts the total at $6.36 billion, about four times the $1.5 billion that walked out of Bybit in February 2025. Most of it left on ten blockchains within roughly 20 minutes of the first transfer at 20:05 UTC.
Binance's initial investigation suggests a compromised DevOps engineer's laptop let an attacker into a service container and submit unauthorized withdrawals. Co-CEO Richard Teng later said the investigation "uncovered additional points of breach."
TRM's best explanation is that the attacker could make Binance's hot wallet signing system sign whatever it wanted. TRM attributes the theft with high confidence to TraderTraitor, the North Korean unit most people lump in with the Lazarus Group.
This is not a Bitcoin failure. TRM puts bitcoin outflows at 18,270 BTC, about $1.47 billion. The address Rob Hamilton pointed to as Binance's cold storage still holds roughly 248,600 BTC and hasn't moved.
Tether froze 971 million USDT 37 minutes after the main sweep, and TRM counts about $2.67 billion in stablecoins frozen overall. If Tether can freeze a hacker's dollars that fast, it can freeze yours. Nobody could freeze the 18,270 BTC.
Expect regulators to say the fix is letting Big Tech and the banks hold your keys. A bigger company is just a bigger single point of failure.
Get your coins off exchanges.