Blockchain analysts suspect North Korea was behind a reported $6.3 billion theft from Binance, as the exchange works to freeze stolen assets and restore withdrawals.
SINGAPORE/TOKYO: Hackers stole $6.3 billion worth of cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what analysts described as a record-breaking digital asset theft, raising fresh concerns about the security of cryptocurrency platforms.
Blockchain analysis firms TRM Labs and Chainalysis said they were highly confident that North Korea was responsible for the attack, which triggered a broad sell-off in cryptocurrency markets. Binance said it would cover all losses and was working with industry partners to freeze the stolen funds.
The attack unfolded largely within approximately 20 minutes late Thursday, according to the analysis firms. Its methods reportedly resembled previous major cryptocurrency thefts attributed to North Korean hackers, including a 2025 attack on crypto exchange Bybit.
TRM Labs said the attackers gained the ability to direct wallets used by Binance to transfer funds into wallets controlled by hackers. The firm attributed the operation to North Korea’s elite hacking unit.
The US Federal Bureau of Investigation previously attributed the Bybit attack to Pyongyang. North Korea has repeatedly denied involvement in cybercrime allegations. Its mission in Geneva and embassy in China did not immediately respond to Reuters’ requests for comment.
Binance promises to cover losses
Binance said customer funds were safe and that it was cooperating with partners to freeze the stolen assets. Approximately $3 billion had been located, while the status of the remaining $3.3 billion was not disclosed.
Co-CEO Richard Teng said on X that the company would cover every loss and that its investigation had not attributed responsibility to any individual.
Binance expected to restore withdrawal services within 48 hours of its announcement.
Stablecoin issuers moved to restrict access to funds linked to the incident. Tether said it had frozen nearly $1.57 billion, while Circle reported freezing more than $800 million.
World Liberty Financial said it worked with custodian BitGo to freeze assets. Binance co-founder Yi He said approximately $27 million in stablecoins and $2 million worth of World Liberty tokens had also been frozen. Ripple reportedly froze another $200 million, according to Yi.
Cryptocurrency prices decline
The news rattled cryptocurrency markets, with Bitcoin falling to a six-week low of $76,368 and Ether dropping more than 3% to a two-month low of $2,178 before prices stabilised.
BNB, the token originally launched as Binance Coin, declined 5% over 24 hours to $709.70, according to CoinGecko.
Shares of Coinbase Global, which said it was unaffected by the incident, fell 4.8%, while shares of Bitcoin-buying company Strategy dropped nearly 6% in extended US trading.
Market participants warned that the breach could further weaken investor confidence in centralised cryptocurrency exchanges.
Compromised engineer’s laptop under investigation
Binance’s initial investigation suggested that the breach may have originated from a compromised laptop belonging to one of its engineers.
The exchange said the device may have provided attackers with access to an internal system, enabling unauthorised withdrawals. Its security team was tracing the full attack path.
Mark Karpeles, former head of the now-defunct Tokyo-based Mt. Gox exchange, said the attackers may have gained access to private keys associated with at least two Binance wallets.
Binance had approximately 335 million registered users worldwide and held around $162.8 billion in assets under custody, according to its 2025 annual report.
The exchange also maintains a Secure Asset Fund for Users, a $1 billion reserve held entirely in Bitcoin to protect customers in cases of security breaches. Co-CEO Teng said company funds would also be used to cover the losses.
The incident adds to a series of major cryptocurrency thefts. TRM Labs researchers said attackers stole approximately $2.9 billion across nearly 150 attacks last year. In September, Bitget reported that around $350 million in cryptocurrency had been stolen from its platform.
About The Author
