Binance Halts Deposits and Withdrawals After $6.3 Billion Crypto Heist Linked to North Korean Hackers A compromised engineer's laptop enabled a North Korean hacker cell to siphon $6.3 billion from Binance, the world’s largest crypto exchange. The exchange has frozen $3 billion in assets, is working with law enforcement to recover the funds, and vows to refresh its proof of reserves. Questions remain over how a single device could access systems that move billions and whether Binance had performed an external security audit before the breach. Binance, the world’s largest cryptocurrency exchange, has halted all deposits and withdrawals after a cyberattack that drained at least $6.3 billion worth of digital assets from its wallets. The breach, the biggest ever recorded in the industry, is believed to have begun when attackers accessed a single engineer’s laptop that was connected to the company’s network. From that compromised device they were able to reach a critical service container and submit a series of unauthorized withdrawal requests that moved billions of dollars out of Binance’ holdings.North Korean hackers linked to Binance attackSecurity researchers working for blockchain intelligence firms TRM Labs and Elliptic have attributed the attack to the North Korean hacker cell known as TraderTraitor. This group is infamous for targeting large crypto exchanges, having previously carried out the second‑largest heist on record-a $1.4 billion theft from Bybit in 2025-and a $351 million raid on Bitget earlier this year.Elliptic noted that some of the stolen Binance funds were moved into a wallet that had been used in the Bitget operation, suggesting a possible shared laundering infrastructure. Binance has not yet confirmed whether private keys were ever compromised. The company insists that the breach involved an authorization or workflow weakness rather than a cryptographic failure, which might explain why the attackers were unable to reach the private keys that control the exchange’s cold storage wallets.Roughly $3 billion of the stolen assets have been frozen by industry partners, and Binance is working with law enforcement, card issuers, and blockchain forensic firms to trace and recover the remaining funds. The exchange has pledged to publish an updated proof of reserves once the remediation process is complete, although it has not yet released any new evidence of user fund safety. The incident raises several hard questions about the security architecture of crypto exchanges.Security safeguards questioned after breachHow could a single employee device provide an attacker with access to a system that controls billions of dollars? What internal safeguards were lacking that allowed a compromised laptop to reach critical containers? And did Binance have a third‑party security audit or continuous penetration testing in place before the attack? Regulators, institutional investors, and the wider crypto community are watching closely.Binance must demonstrate that it is taking decisive action to harden its security posture, communicate transparently with users, and cooperate fully with authorities. The fallout from this theft could reshape industry expectations for security standards and auditing practices, and it may trigger new regulatory scrutiny over how exchanges handle critical infrastructure and employee access controls.In the aftermath, Binance has pledged to improve customer confidence and protect its market position while it continues to work with law enforcement and blockchain intelligence firms to recover stolen assets. The story remains evolving, and the final figures could shift as investigations proceed and more information emerges.