币安遭遇创纪录黑客袭击 约63亿美元资产失窃Binance Suffers Record Cyber Heist as Hackers Steal $6.3 Billion

这起失窃事件发生在周四傍晚。根据行业研究人员和多方通报，黑客绕过平台的多重安全防护机制，侵入了币安的提币系统及平台用户交易账户，在短短约20分钟内便完成了对绝大部分目标资金的非法转移，失窃总额达到约63亿美元，波及对象涵盖日常个人投资者与大型投资基金。

The heist took place on Thursday late afternoon, when hackers bypassed multiple security layers to breach Binance's withdrawal architecture and client trading accounts. According to crypto researchers, the intruders siphoned the bulk of the roughly $6.3 billion in affected assets in a span of about 20 minutes, sweeping up balances belonging to everyday individual traders as well as institutional investment funds.

事发后，币安迅速在周四紧急暂停了平台的充值与提现服务，并随即展开内部溯源调查。币安初步通报表示，黑客从未经授权的加密钱包执行了转账指令，但尚未发现控制相关钱包的私钥发生泄露。币安管理层此前曾推测攻击可能源于运维工程师笔记本电脑遭入侵并由此渗透服务容器，但联合首席执行官邓伟政（Richard Teng）随后澄清，攻击机制涉及更为复杂的手法，公司仍在全面核查失窃的具体技术路径与完整波及范围。

Binance responded by suspending deposits and withdrawals on Thursday and initiating an internal forensic inquiry. The exchange stated in its initial findings that unauthorized transfers were submitted from company crypto wallets, though it found no evidence that private keys controlling those addresses had been compromised. While the company initially weighed whether the breach stemmed from a compromised DevOps engineer's laptop accessing a service container, Co-CEO Richard Teng subsequently noted that the incident involved a more complex attack mechanism, with investigators continuing to evaluate the full scope and technical vectors of the intrusion.

在被盗的约63亿美元资产中，约有一半涉及稳定币。稳定币发行机构在事发后迅速在区块链网络上对相关代币实施了链上冻结，币安也已着手追回这部分被锁定的资产。然而，研究人员指出，其余被盗资产主要为比特币和以太坊等缺乏中心化治理架构的数字代币，黑客转移后极难逆转或追回，这导致币安最终面临的实际敞口损失可能超过30亿美元。

About half of the roughly $6.3 billion siphoned during the breach involved stablecoins, which issuers rapidly froze on-chain across blockchain networks to block hackers from moving or liquidating them. Binance stated that it has already begun recovery procedures for those frozen holdings. By contrast, researchers pointed out that the remaining stolen balances were tied to decentralized tokens such as bitcoin and ether that lack central governing authorities to reverse transactions. Because those non-stablecoin assets are likely impossible to claw back, researchers estimate the exchange's eventual losses could exceed $3 billion.

面对巨额资金缺口，币安公开承诺全额承担客户损失并保障用户资产安全。虽然潜在损失已经大幅超过了币安在2018年设立、规模约10亿美元的投资者保护应急基金（SAFU），但平台相继宣布动用该应急储备并额外划拨超过63亿美元的自有公司资金提供财务兜底。研究人员评估，尽管损失规模庞大，但在币安约1550亿美元的用户总资产盘子中仍属可控承受范围。

Binance pledged that it would make all impacted customers whole, insisting that client funds remain secure. Although potential net losses far exceed the roughly $1 billion stored in the Secure Asset Fund for Users (SAFU)—an emergency reserve established in 2018 for hack events—the exchange stated it would tap SAFU and set aside more than $6.3 billion in corporate capital. Crypto analysts observed that while the gap eclipses dedicated contingency reserves, it represents a manageable fraction of the platform's $155 billion in total user assets.

区块链分析机构TRM Labs与Chainalysis基于链上追踪与情报研判，高置信度指出朝鲜国家背景的黑客组织Lazarus（又称TraderTraitor）是这起失窃案的主要嫌疑方。TRM Labs全球政策主管阿里·雷德博德（Ari Redbord）表示，该事件的筹划与执行高度精密，符合该组织一贯的网络袭击模式。长期以来，外部专家指控朝鲜政府依靠网络犯罪获取资金，但平壤方面始终对类似指控予以坚决否认。

Blockchain analytics firms TRM Labs and Chainalysis identified the Lazarus Group—a North Korean state-backed cyber unit also known as TraderTraitor—with high confidence as the prime suspect behind the theft. Ari Redbord, global head of policy at TRM Labs, noted that the heist was meticulously planned and executed, aligning with North Korea's established history of sophisticated cyber operations. While outside experts routinely accuse the government in Pyongyang of relying on cybercrime to generate state revenue, North Korean authorities have consistently denied involvement in illicit digital asset thefts.

过往执法记录显示了类似手法的运用。去年，美国联邦调查局（FBI）曾指控该朝鲜黑客组织策划了对总部位于迪拜的Bybit交易所的袭击并盗取约15亿美元。FBI当时指出，黑客得手后迅速转移并分散被盗资产，将其兑换为比特币等数字资产，最终目标是套现为法定硬通货。相关报告称，该国通过选拔高校优秀学生并纳入情报机构监管来系统化建立黑客队伍，网络行动很大程度上聚焦于获取经济利益。

Investigative agencies have previously observed this operational pattern in prior cryptocurrency breaches. Last year, the Federal Bureau of Investigation attributed the $1.5 billion theft from Dubai-based exchange Bybit to the TraderTraitor apparatus. In that incident, the FBI detailed how operatives moved rapidly to launder and disperse stolen holdings, converting balances into bitcoin and other digital currencies with the ultimate objective of cashing them out into hard currency. According to reports, the state recruits promising students from universities into intelligence-overseen hacking units, focusing operations heavily on monetary gain.

这起失窃案再次引发了对中心化平台托管安全与数字资产存储风险的审视。历史记录显示，交易所遭受黑客攻击并不罕见，迪拜的Bybit在2025年被盗约15亿美元，塞舌尔注册的Bitget在2026年9月也损失超过3.87亿美元。安全专家指出，依靠财务兜底并非长久之计。加密基础设施公司Global Settlement Network首席执行官瑞安·柯克利（Ryan Kirkley）在邮件中表示，币安拥有吸收损失的资产负债表固然令人宽慰，但不应将财务实力与运营安全混为一谈，全球最大交易平台依赖紧急冻结和赔付承诺，对于期望吸引更多机构资本的加密行业而言是一个严重问题。

The massive heist has revived scrutiny over custody risks and the hazards investors face when entrusting digital tokens to centralized trading platforms. Hacks across the sector have occurred repeatedly: attackers siphoned roughly $1.5 billion from Dubai-based Bybit in 2025, while Seychelles-registered Bitget lost more than $387 million in September 2026. Security experts cautioned that absorbing customer losses through capital reserves fails to provide an enduring defense. Ryan Kirkley, chief executive of crypto infrastructure firm Global Settlement Network, wrote in an email that while Binance possesses the balance sheet strength to absorb the financial damage, financial capability should not be confused with operational security. He added that the world's dominant crypto exchange relying on emergency freezes and reimbursement pledges poses a serious problem for an industry asking institutions to commit substantially more capital.

事件发生后，加密生态各方迅速收紧防护措施。同业竞争交易平台随即对资金流动设置了额外的预警与限制，防止可疑资产继续流窜。就在币安暂停充提币数小时前，加密预测市场Polymarket也遭遇了自6月以来的第二次安全事件，分析机构Bubblemaps数据显示约700名用户因未经授权的提现损失270万美元。虽然该事件被认为与币安案无关，但密集的系统漏洞和盗窃事件使得业界对依靠资产负债表兜底而非筑牢底层防御的做法产生更深疑虑。

Across the crypto ecosystem, platforms moved rapidly to implement protective measures. Competing exchanges placed additional alerts and restrictions on the movement of funds to guard against illicit transactions. Just hours before Binance froze deposits and withdrawals, crypto-powered prediction market Polymarket suffered its second apparent intrusion since June, with analytics firm Bubblemaps reporting that about 700 users lost $2.7 million in unauthorized withdrawals. While researchers view that incident as unrelated to Binance's breach, the sequence of security failures has intensified doubts about an industry increasingly forced to rely on balance-sheet backstops rather than structural cyber defenses.