Cryptocurrency giant Binance said on Thursday that $6.3bn (£4.7bn) in digital assets were affected by what is believed to be the biggest crypto hack on record.
The world’s biggest crypto exchange said about half of those assets had been frozen, but many remained in the hackers’ hands, adding that it will “cover all losses”.
The company said while initial checks suggested an engineer’s laptop had been compromised, allowing an attacker to make unauthorised withdrawals, “our subsequent investigation has uncovered additional points of breach”.
Two analytics firms have attributed the incident, which eclipses a record-setting $1.5bn hack on the Bybit exchange in 2025, to a North Korean hacking unit called TraderTraitor.
Cybersecurity firm Check Point said the unit is also known in the industry as Lazarus Group, which has been blamed for the 2025 hack.
Check Point’s chief information security officer, Jayant Dave, said the losses Binance estimated made it “the largest crypto theft on record”.
AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.
The lab’s global head of policy Ari Redbord told the BBC the Binance hack is a “watershed moment” that is unlike anything the industry has seen.
The attacker still holds a massive sum of stolen assets, so efforts to trace and recover the funds are far from over, Redbord added.
Binance, which was founded in China in 2017, allows users to trade digital assets and is estimated to have more than 300 million registered users worldwide.
In 2024, the company said it has more than $160bn in assets under its custody.
The exchange has been subject of regulatory scrutiny around the world.
Chainalysis, a crypto analytics firm, also said it has “high confidence” that the North Korean group are linked to the hack.
For the last few years North Korea-linked operatives have focussed on attacking cryptocurrency companies for large thefts of digital tokens.
Western security agencies have previously said stolen funds are used to finance North Korea’s nuclear weapons and missile development programs.
The regime has denied involvement in past hacks.
Eric Jardine, Chainalysis’ Head of Research, urged every exchange to remain vigilant as the platforms are attractive targets for hackers due to the sheer value of assets.
Binance did not directly respond to BBC questions about the incident’s potential links to North Korea but said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”
The incident concerns Binance.com – while much smaller crypto platform Binance.US, which provides trading services specifically for American residents – said its platform is not affected by the issue.
Binance co-CEO Richard Teng said the company’s initial investigation suggested the hack started with a compromised engineer’s laptop.
“That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions,” he said in a statement.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”
He said a detailed “post-mortem” would be shared once the investigation was complete.
In an update, the company said in a statement on X that another investigation found there had been other breach points: “We are still gathering the facts, and will share more directly as we have them.”
Check Point’s Dave said this attack also resembled a hack on crypto exchange platform Bitget in September in which $388m (£289m) was lost: “This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them.”
In a series of posts, Yi He, Binance’s co-chief executive, thanked various cryptocurrency issuers for freezing the assets.
“Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,” she said.
Two other major crypto platforms, Tether and Circle, said they had frozen a total of about $2.4bn of assets in response to the potential Binance hack.
World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it has worked with its partners to freeze stolen funds.
Crypto exchange Coinbase said it was unaffected by the incident and was monitoring the situation.
Several crypto industry observers had flagged concerns about a potential hack on Binance hours before the exchange confirmed the security issue.
Bitcoin dropped by more than 4% following the alerts. The price of other major cryptocurrencies including Ethereum and Solana also fell sharply.
Source: BBC
