Thirty Minutes

Shortly after four Thursday afternoon, Eastern time, five wallets controlled by Binance, the world’s largest cryptocurrency exchange, began hemorrhaging digital assets. The first transfers totaled roughly $300 million. Then the attackers struck again and again across ten blockchains. Within half an hour, nearly all of $6.3 billion was gone. A smaller wave followed hours later.

To put that in perspective, the previous record for a crypto theft was the $1.5 billion North Korean hackers took from the exchange Bybit in February 2025. This one is more than four times larger. Elliptic, a blockchain analytics firm, calls it almost certainly the largest theft of any kind in history, surpassing even the roughly $1 billion Saddam Hussein’s regime hauled out of Iraq’s central bank in 2003. Saddam needed trucks. These thieves needed access to Binance’s transaction systems and half an hour.

Binance quickly froze withdrawals and assured its 335 million registered users that their money was safe. That reassurance is the real story here. Cryptocurrency was sold as a way to escape banks and financial gatekeepers. Binance became one of the largest gatekeepers of all. So when that money vanished, who actually stood behind the promise to get it back?

The answer says a great deal about what crypto has become.

The revolution against financial gatekeepers was rescued by financial gatekeepers.

Within hours of the theft, Tether froze approximately $1.77 billion of the stolen funds, and Circle froze more than $800 million. Both companies issue stablecoins, digital tokens pegged to the dollar, and both retain the power to blacklist wallets holding their coins. With a few keystrokes, they immobilized billions. Ripple and other issuers intervened as well, while World Liberty Financial, the Trump family’s crypto venture, worked with BitGo to freeze roughly $28 million in USD1.

Even Arbitrum, a network built around decentralization, demonstrated how much power remains at the center. Its Security Council temporarily modified the network’s transaction infrastructure, moved roughly $30 million out of an attacker’s wallet without authorization, then restored the original code. All told, Binance says about $3 billion has been frozen, though frozen doesn’t mean recovered.

The attackers knew the emergency brakes were coming. According to the Financial Times, they managed to exchange $934 million in Tether for tokens beyond issuer-controlled freezing, accepting steep losses to get there before Tether and Circle locked down their wallets. According to TRM Labs, roughly $2.4 billion in those assets had already escaped issuer-controlled freezing mechanisms, although investigators can still trace the money.

The parts of crypto with an emergency brake could stop the thieves. The parts without one left investigators chasing the money.

Banks have the FDIC. Binance has SAFU. Not to be confused with SNAFU, although the resemblance is difficult to ignore.

Believe it or not, the name began as an internet joke. In 2018, a YouTuber made a viral video mocking founder Changpeng Zhao’s repeated assurances that customers’ funds were safe, turning the phrase into “Funds Are Safu.” Binance liked the joke enough to name its emergency reserve after it.

The Secure Asset Fund for Users, set up in 2018, is the exchange’s emergency reserve for exactly this kind of disaster. As of Thursday, it held about $1.23 billion, roughly a fifth of what was stolen. And it’s held entirely in bitcoin, which fell about 5 percent on news of the hack. The fund lost around $100 million in value because of the very event it was meant to cover. It’s like buying insurance against a financial disaster, only to discover that your policy loses value when the disaster arrives.

Conventional insurance won’t fill the gap either. Most crime and cyber policies don’t cover stolen cryptocurrency, and crypto-specific coverage remains a niche product.

So Binance is covering the rest itself. The company says it has set aside more than $6.3 billion, including the SAFU fund, about $5 billion of it in the same coins the hackers took. It’s buying the remaining $1.3 billion on the open market. Binance insists it can absorb the loss, and at least one prominent analyst sees no immediate solvency threat. But the company’s assurances still need to be tested against its actual reserves. On Friday, Binance’s co-CEO, Yi He, publicly reassured her co-founder and partner, Changpeng Zhao, on X that the company’s revenue could cover the losses, and that there was no need yet to sell the SpaceX shares he’s bullish on.

That’s what “your money is safe” means at the world’s largest crypto exchange: no government-backed deposit insurance, no independent guarantee that the company can absorb the loss. Just Binance’s own balance sheet and its executives’ promise to make customers whole.

Which raises an obvious question: who are the people making that promise?

Behind the company making that promise stands Changpeng Zhao, Binance’s founder and largest shareholder, whose personal fortune exceeds $100 billion.

Zhao’s record bears repeating. In 2023, Binance pleaded guilty to federal anti-money-laundering, unlicensed money transmitting, and sanctions violations and agreed to pay approximately $4.3 billion in penalties, one of the largest corporate penalties in U.S. history. Treasury found the exchange had failed to report suspicious transactions involving terrorist groups, including Hamas. Zhao himself pleaded guilty to failing to maintain an effective anti-money-laundering program and served four months in prison.

In October 2025, after Binance spent roughly $800,000 lobbying for clemency and other policy changes, President Trump pardoned him. The White House called the prosecution part of the Biden administration’s “war on cryptocurrency.” Critics pointed to a different context: months earlier, Binance had accepted a $2 billion investment from an Abu Dhabi state fund, paid entirely in USD1, the Trump family’s World Liberty Financial stablecoin. By February 2026, Binance-controlled wallets, including customer holdings, accounted for approximately 87 percent of all USD1 in circulation.

Asked on 60 Minutes why he’d pardoned Zhao, Trump answered, “I don’t know who he is.”

After Thursday’s heist, Zhao posted that he no longer runs Binance but, as a shareholder, expects all user funds to be covered.

There’s a certain irony in the history. Three years ago, the United States penalized Binance for allowing illicit actors to move money through its platform. Now investigators suspect that North Korean operatives have stolen billions directly from it.

Blockchain analysts at TRM Labs and Chainalysis attribute the theft to TraderTraitor, an elite North Korean hacking unit. Elliptic agrees that North Korean involvement is likely. Neither the FBI nor Binance has confirmed the attribution. But if the analysts are right, this was no ordinary crime.

North Korea’s hackers aren’t freelancers. The U.S. Treasury says the broader Lazarus Group operates under the Reconnaissance General Bureau, the country’s main intelligence agency. According to a 2024 UN report, one member state estimated that cybercrime generated half of North Korea’s foreign-currency income. Another estimated that illicit cyberactivity financed 40 percent of its weapons-of-mass-destruction programs.

By Elliptic’s count, North Korean hackers had already stolen more than $6.5 billion in cryptocurrency before Thursday. This single heist, if attributed correctly, nearly doubles that total. But stolen doesn’t necessarily mean spendable. Roughly $3 billion has been frozen, and investigators are tracing the rest. Converting the remaining cryptocurrency into usable money requires laundering networks and intermediaries who take their share. How much ultimately reaches Pyongyang remains unknown, but whatever does could help finance weapons programs that international sanctions were designed to constrain.

Ciaran Martin, Britain’s former head of national cyber defense, called it “their best day at the office yet.”

For a sanctioned nuclear state, cryptocurrency has become something the old sanctions regime never anticipated: a vault you can rob from the other side of the world.

Binance may succeed in making every customer whole. It has promised to do exactly that. But replacing stolen money isn’t the same as recovering it. If the analysts are right about North Korea, some of those assets may eventually finance weapons programs long after Binance has restored its customers’ balances.

Consider what it took to protect those customers: private companies powerful enough to freeze transactions, an emergency fund that couldn’t cover the loss, and an exchange promising to make up the difference from its own treasury. There was no government-backed deposit insurer standing behind them. Customers remained dependent on the decisions and financial resources of powerful intermediaries.

Crypto promised to abolish that arrangement. Instead, it rebuilt it on a blockchain.

Share

Leave a comment

Subscribe now

SAFU Meets SNAFU