"That gave an attacker access to a service container"
Cryptocurrency giant Binance said $6.3 billion (£4.7 billion) worth of digital assets have been affected by what is believed to be the biggest cryptocurrency hack on record.
The world’s largest crypto exchange said around half of the affected assets had been frozen, but a significant amount remained in the hands of hackers.
It has pledged to “cover all losses” as investigations into the security breach continue.
Preliminary findings suggest the attack may have originated from an engineer’s compromised laptop, which allowed an attacker to carry out unauthorised withdrawals.
However, the company stressed that the incident involved a more complex process than simply exploiting an individual’s permissions.
Two cryptocurrency analytics firms have attributed the attack to a North Korean hacking unit known as TraderTraitor, which is also associated with the Lazarus Group.
The group has previously been linked to several major cryptocurrency thefts, including the $1.5bn hack of crypto exchange Bybit in 2025.
Cybersecurity firm Check Point’s chief information security officer, Jayant Dave, said the losses estimated by Binance made it “the largest crypto theft on record”.
AI-powered investigations company TRM Labs also identified similarities between the Binance incident and previous attacks attributed to North Korean hackers.
Its global head of policy, Ari Redbord, called the breach a “watershed moment” that was unlike anything the cryptocurrency industry had previously experienced.
Redbord warned that the attacker still holds an enormous amount of stolen assets, meaning efforts to trace and recover the funds are far from over.
Chainalysis, another cryptocurrency analytics firm, said it had “high confidence” that the North Korean group was linked to the incident.
Its head of research, Eric Jardine, urged cryptocurrency exchanges to remain vigilant, warning that the substantial value of assets held by these platforms makes them attractive targets for cybercriminals.
North Korean-linked operatives have increasingly targeted cryptocurrency companies in recent years, stealing large quantities of digital tokens.
Western security agencies have previously alleged that funds obtained through such attacks are used to finance North Korea’s nuclear weapons and missile development programmes. The regime has denied involvement in hacking incidents in the past.
Binance co-CEO Richard Teng said in a statement:
“That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.
“It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”
Teng added that Binance would share a detailed “post-mortem” once its investigation had been completed.
Check Point’s Dave said the attack also bore similarities to a September incident involving cryptocurrency exchange Bitget, in which $388m (£289m) was lost.
Binance co-chief executive Yi He thanked several cryptocurrency issuers for helping freeze the affected assets in a series of social media posts.
She also confirmed that withdrawals had been temporarily suspended while the company worked to secure its systems.
Other major cryptocurrency platforms have also taken action following the incident.
Tether and Circle said they had frozen approximately $2.4bn worth of assets in response to the potential Binance hack, while World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said it had worked with partners to freeze stolen funds.
Meanwhile, cryptocurrency exchange Coinbase confirmed that its platform had not been affected and said it was monitoring the situation.
The incident relates specifically to Binance.com, the company’s main international trading platform. Binance.US, a separate and significantly smaller exchange serving American residents, confirmed that its platform was not affected.
Founded in China in 2017, Binance allows users worldwide to buy, sell and trade digital assets and is estimated to have more than 300 million registered users.
The company said in 2024 that it held more than $160bn in assets under its custody, although it has also faced regulatory scrutiny in several countries.
