Binance Breach: The Facts, the Response and Where Your Bitcoin Stands

Binance, the world’s largest crypto exchange, has confirmed a security breach with an estimated total impact of about $6.3bn (approximately $9bn AUD). That is roughly four times the $1.5bn Bybit lost in February 2025, the previous record. This report sticks to what has been confirmed and sets out what it means for you.

The Short Version

Binance says user funds are safe and that it will cover all losses. About $3bn of the affected assets has already been frozen. The breach was of Binance’s own internal systems, not Bitcoin itself.

What Happened

Shortly before 7:30 am AEDT on Friday, a rapid series of transfers began draining several of Binance’s hot wallets, the online wallets exchanges use to process day-to-day withdrawals.

Binance’s initial investigation suggests an attacker compromised a DevOps engineer’s laptop, used it to reach an internal service and submitted unauthorised withdrawals. Binance says it has found no evidence that any private key was leaked and will publish a full post-mortem once its investigation is complete.

The assets taken included about 18,000 BTC, worth around $1.4bn (approximately $2bn AUD), alongside large amounts of USDT, USDC and ETH.. Blockchain analytics firms TRM Labs and Chainalysis have linked the attack to a North Korean hacking unit tied to the Lazarus Group, the group behind the Bybit hack. Binance has not confirmed who was responsible.

What Binance Has Done

Binance suspended deposits and withdrawals, revoked the affected permissions and brought in law enforcement and blockchain investigators. It has pledged to cover all losses from its Secure Asset Fund for Users (SAFU) and its own company funds, and to publish an updated proof of reserves. Binance.US was not affected.

SAFU, Binance’s emergency reserve, was converted entirely into Bitcoin in February and holds 15,000 BTC, about $1.2bn at today’s prices. With roughly $3.3bn of the affected assets not yet frozen, most of the cost is likely to fall on Binance’s own balance sheet.

How $3bn Was Frozen in Hours

Much of what was taken was in stablecoins, which their issuers can freeze. Tether froze more than $1.5bn of USDT and Circle more than $800m of USDC, with Ripple and the Arbitrum network also acting.

The Bitcoin taken sits outside anyone’s reach. Bitcoin has no company behind it that can freeze coins, and that is exactly what protects holders from confiscation. It is also why control of the keys matters so much.

The stolen Bitcoin has been split across 19 wallets and, as of this morning, had not moved. Every coin is traceable on-chain, and exchanges and OTC desks will be watching for it, which analysts expect to make it hard to sell quickly.

How the Market Reacted

Bitcoin fell nearly 5% and briefly dipped below $77,000, a six-week low. Ether fell to its lowest price since 20 August and BNB dropped about 7%. About $1.5bn of leveraged positions were liquidated over the day, more than $600m of it in the first hour.

A Bigger Hack, the Same Reaction

When Bybit lost about $1.5bn in February 2025, Bitcoin fell more than 5% from its high near $99,500. Today’s hack is four times larger, yet Bitcoin’s drop was about the same, at nearly 5%.

Buyers also stepped in quickly. Bitcoin held above the September low near $75,000 and recovered to around $78,400 within hours. In our view, that points to a market with real demand at these levels, and one that is absorbing shocks better than it used to.

It is early. After Bybit, Bitcoin’s larger fall came in the following week, as the hack added to a broader sell-off. Binance has not yet set a date for reopening withdrawals, and how it handles the coming days will matter.

The recovery playbook itself is well established. Bybit restored its reserves to 1:1 within 72 hours, and when Binance lost 7,000 BTC in 2019, it covered the losses and reopened withdrawals after about a week.

What This Means for Stormrake Clients

Stormrake holds no exposure to Binance, so client assets are completely unaffected by this breach. The same goes for Bitcoin held in your own wallet.

Your Broker Is Here to Talk It Through

Through every hour of this incident, the Bitcoin network kept producing blocks and settling transactions as designed.

If you have questions about your holdings, how your Bitcoin is held or what this means for the market, your dedicated Stormrake broker is here to talk it through. Simply get in touch.

---

*All prices are denominated in USD unless stated otherwise*

---

Written by James Ryan & Alexandar Artis