Cryptocurrency exchange Binance confirmed on Thursday that $6.3bn (£4.7bn) in digital assets were compromised in an attack suspected to be the largest crypto hack in history. The company stated that while it has managed to freeze approximately half of the stolen assets, a significant portion remains in the hands of the attackers.
Binance pledged to cover all losses resulting from the incident. The exchange, which serves more than 300 million registered users globally and holds over $160bn in assets under custody, has disabled withdrawals across its platform until the security environment is confirmed to be safe.
Multiple Breach Points Identified
Richard Teng, co-chief executive of Binance, explained that the initial investigation pointed to a compromised engineer’s laptop. This access allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. However, subsequent reviews revealed a more complex attack process involving additional points of breach.
Teng emphasized that the incident was not a simple one-click action using a single engineer’s permissions. He added that the investigation has found no evidence of any wallet private key leaks. A detailed post-mortem report will be shared once the inquiry is complete.
Check Point, a cybersecurity firm, noted that the attack methodology resembles a September hack on Bitget where $388m was lost. Jayant Dave, chief information security officer at Check Point, stated that the attackers no longer need vault keys but instead target the systems and people with authority to use them.
North Korean Link and Market Impact
Two major analytics firms, Check Point and TRM Labs, have attributed the Binance hack to a North Korean hacking unit known as TraderTraitor or the Lazarus Group. This group was also blamed for a $1.5bn hack on the Bybit exchange in 2025. Chainalysis, another analytics provider, expressed high confidence in this attribution.
Western security agencies have previously linked stolen cryptocurrency funds to the financing of North Korea’s nuclear weapons and missile development programs. Ari Redbord, global head of policy at TRM Labs, described the Binance hack as a watershed moment for the industry, noting that efforts to trace and recover the funds are far from over.
The news triggered immediate volatility in the cryptocurrency market. Bitcoin prices dropped by more than 4% following alerts of the breach. Other major digital assets, including Ethereum and Solana, also saw sharp declines. Binance.US, a separate platform for American residents, confirmed it was unaffected by the incident.
Major stablecoin issuers Tether and Circle froze approximately $2.4bn of assets in response to the hack. World Liberty Financial, a crypto firm linked to US President Donald Trump, also reported working with partners to freeze stolen funds. Coinbase stated it was monitoring the situation but remained unaffected. Binance is currently working with law enforcement partners to identify the criminals involved.
Source: BBC
