Binance, the world’s largest cryptocurrency exchange, has suffered a $6.3bn security breach in what analysts describe as the biggest crypto theft on record, with US blockchain intelligence firms attributing the attack to North Korean hackers.
The incident triggered a fall in cryptocurrency prices, prompting Binance to suspend withdrawals while assuring customers that their funds were safe. The exchange also pledged to cover the losses as it works with law enforcement agencies and industry partners to recover the stolen assets.
Binance said it had traced about $3bn of the stolen funds, with several stablecoin issuers freezing assets linked to the attack. However, the company did not provide details on the whereabouts of the remaining $3.3bn.
The exchange expects to restore withdrawal services within 45 hours, while its co-chief executive, Richard Teng, said company funds would be used to cover any losses.
The bulk of the theft reportedly took place within about 20 minutes late on Thursday. Blockchain analysis firms TRM Labs and Chainalysis said the method used bore similarities to previous major attacks associated with North Korea.
TRM Labs linked the operation to North Korea’s elite hacking unit, while Chainalysis also expressed high confidence that the country was responsible. The analysts said the attackers appeared to have manipulated wallets used by Binance to transfer assets into accounts under their control, a technique similar to the 2025 attack on crypto exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korea.
North Korea has repeatedly been accused by US and South Korean authorities, as well as cybersecurity experts, of using state-linked hacking groups to conduct espionage and steal funds to generate revenue. Pyongyang routinely denies such allegations.
Binance said its security team was investigating how the attackers gained access to its systems. An initial assessment suggested that a laptop belonging to one of its engineers may have been compromised, potentially providing an entry point for the breach. The company later disclosed that investigators had identified additional points of compromise.
Former Mt Gox chief Mark Karpeles suggested that the attackers may have obtained private keys linked to at least two Binance wallets. He noted that the exchange appeared to distribute its assets across different systems, limiting the amount that could be exposed in a single breach, although the incident still resulted in substantial losses.
Crypto markets react to record theft
The scale of the breach unsettled cryptocurrency markets, with major digital assets recording losses before prices began to stabilize.
Bitcoin dropped to a six-week low of $76,368, while Ethereum fell by more than three per cent to $2,178, its lowest level in two months.
BNB, the token launched by Binance and used partly to pay trading fees on the platform, was down five per cent over 24 hours at $709.70, according to CoinGecko.
The impact also spread to publicly traded companies linked to the cryptocurrency industry. Shares in Coinbase Global, which said it was not affected by the incident, fell 4.8 per cent, while those of bitcoin-buying company Strategy declined by nearly six per cent in extended US trading.
Market analysts warned that the breach could further weaken investor confidence in digital assets, particularly as the sector was already facing pressure from higher US interest rates and softer demand from exchange-traded fund investors.
Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said the incident could make investors reconsider the risks of keeping their cryptocurrency on centralised exchanges.
Billions frozen as recovery efforts continue
Binance operates a Secure Asset Fund for Users, a reserve reportedly worth $1bn in bitcoin and established to protect customers in the event of security incidents. However, the $6.3bn theft is significantly larger than the fund.
The exchange had 335 million registered users worldwide and held approximately $162.8bn in assets under custody, according to its 2025 annual report.
Several cryptocurrency companies have moved to freeze funds connected to the attack. Stablecoin issuer Tether said it had blocked nearly $1.57bn in related assets, while Circle froze more than $800m.
World Liberty Financial, a cryptocurrency venture backed by US President Donald Trump, said it worked with digital asset custodian BitGo to freeze funds. Binance co-founder Yi He also disclosed that about $27m in stablecoins and approximately $2m worth of World Liberty tokens had been frozen.
Cryptocurrency firm Ripple reportedly froze another $200m linked to the incident.
The breach adds to a series of major thefts affecting the digital asset industry. TRM Labs researchers estimated that hackers stole $2.9bn in cryptocurrency across nearly 150 attacks last year.
In September, crypto exchange Bitget also reported that about $350m in digital assets had been stolen from its platform.
Moody’s Ratings Vice President for Digital Assets, Cristiano Ventricelli, said the wider consequences of the Binance incident would depend on how much of the stolen money could be recovered, the extent of losses suffered by affected parties and whether the breach triggers further disruption or a broader loss of confidence in the cryptocurrency market.
