Key numbers
US$6.3bn (about £4.7bn): Binance’s estimate of the total impact
US$3bn: frozen so far with help from industry partners
US$3.3bn: still outstanding, including about US$2.4bn in bitcoin and ether
US$1bn–1.2bn: estimated size of Binance’s own protection fund
US$1.5bn: the previous record, Bybit, February 2025
Sterling conversions at about US$1.34. Figures approximate and changing.
Binance, the world’s largest cryptocurrency exchange, has suspended all deposits and withdrawals while it investigates a breach it puts at US$6.3bn. That is more than four times the previous record for a crypto theft.
On-chain data shows the first large outflow from a Binance hot wallet at 8.24pm GMT on Thursday. Binance paused withdrawals shortly after 10pm. Soon afterwards, co-founder Changpeng Zhao posted on X: “It does look like a hack on Binance.”
According to Binance’s preliminary investigation, the attacker got in through a compromised laptop belonging to a DevOps engineer, then used it to reach an internal service and submit unauthorised withdrawals. Binance says it has found no evidence that wallet private keys were leaked. At least one blockchain security firm has disputed that account. Binance has promised to cover all losses from its Secure Asset Fund for Users (SAFU) and from company funds.
The breach has a direct UK connection. In 2021 the FCA barred Binance’s UK arm from carrying on regulated activity. Binance then stopped taking new UK customers in October 2023, although existing accounts continued to trade. In August, Binance was reported to be preparing an application under the FCA’s new crypto regime. Binance has not said how many UK customers are affected by the freeze.
Read next: WTW just made a big move on crypto insurance - shrewd, or big risk?
Binance is covering the loss itself. It set up SAFU in 2018 and still owns and manages it. The fund is held entirely in bitcoin and is worth roughly US$1bn to US$1.2bn, depending on the price of bitcoin. That covers less than a fifth of the estimated loss, so most of the money will come from Binance’s balance sheet.
Much of the specialist capacity for crypto theft sits in London. Evertas writes its cover with backing from Arch, a Lloyd’s syndicate member. In June, WTW bought Redefind, an MGA that writes crypto theft insurance on Lloyd’s paper. Capacity has grown this year, but publicly reported limits are a small fraction of a US$6.3bn loss.
Recovering the frozen funds will take time. Redbord told CNBC that returning frozen stablecoins to their owners usually requires legal proceedings, and there is no standard timeline.
The North Korean link will send claims teams straight to their wordings. Under Lloyd’s Market Bulletin Y5381, standalone cyber policies written at Lloyd’s since 31 March 2023 must exclude two things. The first is war. The second is any state-backed attack that significantly impairs a state’s ability to function or its security capabilities. The bulletin also requires each policy to set out a robust basis for attributing an attack to a state.
That test is aimed at attacks with national-scale consequences. Whether a theft from a private exchange meets it is open to argument, and wordings vary between policies. Brokers have warned of grey areas since the mandate was announced. Clear Group’s George Grimshaw has told Insurance Business that cyber cover is “not going to cover anything when it comes to war or state-backed attacks”. Under war exclusions, the insurer generally carries the burden of proving the exclusion applies.
Formal attribution will matter. After the Bybit theft, the FBI named TraderTraitor within a week. A similar statement this time would strengthen the hand of any insurer arguing that the loss was state-backed.
Read next: War exclusions protect insurers as cyber spillover risk emerges
The FCA published its final cryptoasset rules on 30 June. Its authorisation gateway opened on 30 September and closes on 28 February 2027, and the regime comes into force on 25 October 2027. PwC’s summary says that firms involved in trading, custody, intermediation and staking will all need authorisation.
The senior managers and certification regime is part of the new framework. Directors of newly authorised crypto firms will therefore carry personal accountability, which is likely to make them look harder at D&O cover. All this is happening while the market absorbs the largest crypto loss on record. Lloyd’s had already warned that rapid cyber growth may be outstripping the market’s capacity to absorb risk.
Read next: Lloyd’s new cyber mandate spurs “grey area” fears
The Binance breach follows Bitget’s loss of roughly US$350m in September. TRM Labs says North Korea-linked groups took about 76% of all crypto hack value in the first four months of 2026.
Prices fell overnight. Bitcoin dropped more than 3% to a six-week low, and BNB, Binance’s own token, fell between 5% and 8%. Tim Sun, senior researcher at HashKey Group, told Reuters the breach could prompt investors to reassess counterparty, solvency and liquidity risk at centralised exchanges.
Kevin March, co-founder of JPEG Trading, told The Wall Street Journal he expected Binance to manage the loss. Its rivals are watching. Few exchanges hold reserves that could absorb a single loss on this scale.
This story is developing and will be updated.
Read next: Markel introduces cyber war cover for indirect losses from state-linked attacks
