Hey, it's Marc.
Welcome to a special PRO briefing of the 51 Insights digital asset newsletter on:
how Binance lost $6.3 billion in minutes.
In this note:
How hackers got Binance's own system to sign away $6.3 billion in about 20 minutes
Why stablecoin freezes saved almost half, and not one stolen bitcoin
Whether Binance can cover the loss, and the math behind it
The three open questions that decide what this costs the rest of the industry
What to ask your exchange, your stablecoin issuer and your board this week
Let’s unpack 👇
What's happening: Binance, the world's largest crypto exchange, said late Thursday that a "security incident" hit about $6.3 billion of assets. That is the largest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025, according to TRM Labs. Elliptic goes further: at its count of $6.43 billion, this is almost certainly the largest theft of any kind.
Binance halted withdrawals. Co-CEO Richard Teng told customers their "money is safe, and we're covering every loss." The company set aside $6.34 billion of company money to cover losses.
TRM and Chainalysis tie the attack to TraderTraitor, a North Korean state hacking unit. No government has confirmed that yet.
In plain English:
A hot wallet is the online wallet an exchange uses to pay out withdrawals. The attacker emptied Binance hot wallets on ten blockchains, most of it in about 20 minutes.
Binance says it found no sign its private keys leaked. The attacker got Binance's own signing system, the machinery that approves each payout, to sign its transfers.
A freezable coin has an issuer that can lock a wallet: Tether for USDT, Circle for USDC. An unfreezable coin, like bitcoin or ether, has no issuer, so nobody can stop it.
Frozen is not returned. Getting the money back takes a separate legal process, TRM's Ari Redbord told CNBC.
Binance customers should be made whole. Binance has pledged to cover every loss, but withdrawals stay paused until about Sunday.
Why it matters: The easy read is "crypto exchanges still get robbed." We think that misses two things. The cryptography held: the attacker went through the people and machines around the keys. And the freeze button crypto purists love to hate stopped about $2.7 billion within about four hours, while not one stolen bitcoin was stopped. Our read in one line: the keys held, the signing desk broke, and the freeze button saved almost half.
Exhibit 1. Every dollar stopped came from a coin with an issuer. Issuers froze about $2.67 billion of the roughly $3.46 billion in stolen stablecoins (77%); nothing stolen on Bitcoin or the XRP Ledger was frozen. Arbitrum's Security Council separately seized 8,426 ETH and 74.6M ARB on its own network. Source: TRM Labs; Elliptic; 51 Insights analysis.
Subscribe to Pro + Intel to read the rest.
Become a paying subscriber of Pro + Intel to get access to this post and the 51 Intel platform.
UpgradeA subscription gets you:
- Full access to the 51 Intel platform
- Company intelligence and vendor comparisons
- Market maps and the Adoption Index
- Monitoring of news, regulation and key events
- Ask51, are AI terminal with full data access
- Exclusive research and briefings