Binance said on Thursday that $6.3bn (£4.7bn) of digital assets have been affected by what has been described as the "largest hack in history". The world's biggest crypto exchange says about half of those assets have been frozen with the help of other platforms, and that it will "cover all losses". That promise matters, but it does not answer the harder question the episode raises: why a single compromised engineer's laptop could open the door to a loss of this size.
According to Binance's early checks, the incident may have involved an engineer's laptop that had been compromised, allowing an attacker to make unauthorised withdrawals. If that account holds, the failure was not an exotic piece of code breaking under pressure. It was an ordinary endpoint, the kind of device every large firm depends on, becoming the point of entry for an enormous theft. Any company holding customer funds at this scale should be asking hard questions about how that access was granted and how quickly it was detected.
Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor. TRM Labs said several elements resemble earlier North Korean-linked incidents, including the Bybit hack, which was a record at $1.5bn in 2025. Chainalysis said it has "high confidence" in the link. Binance has not directly answered questions about North Korea, saying only that it is working with law enforcement to confirm the identity of the criminals. Those attributions should be treated as the analysts' findings, not settled fact, until investigators say more.
The freezes by Tether and Circle, which together froze about $2.4bn, show that the industry can act quickly when a shared threat appears. Yet the reliance on other firms to stop the money is itself a sign of fragility. Recovery depends on stablecoin issuers and partners choosing to act, and on criminals not yet having moved the remainder. Regulators who have already scrutinised Binance for years should press it for a full public account of its controls, not just assurances that losses will be covered.
Binance says its platform is safe and withdrawals remain disabled until the environment is confirmed secure. That caution is right. Users who hold funds on the exchange deserve clear, timely updates, and the company should publish a detailed post-incident report. Until it does, the claim that the industry is maturing will sound hollow.