Hackers have stolen approximately $6.3bn from Binance, the world’s largest cryptocurrency exchange, in what analysts have described as the biggest known financial theft, with North Korea suspected of carrying out the attack.
The breach has triggered a sharp decline in cryptocurrency prices, forcing Binance to temporarily suspend withdrawals and pledge to cover all customer losses with its own funds.
The exchange is also working with law enforcement agencies across the world, including the United States Federal Bureau of Investigation (FBI) and the United States Secret Service (USSS), to investigate the attack and trace the stolen assets, a person familiar with the matter told Reuters.
Binance said it was cooperating with the authorities and other cryptocurrency companies to recover the funds, with about $3bn already located and portions of the stolen assets frozen.
The attack, which unfolded within approximately 20 minutes late on Thursday, has been linked to North Korea by several blockchain analysis firms.
US-based firms TRM Labs and Chainalysis said they were highly confident that North Korea was responsible, while British blockchain intelligence firm Elliptic also attributed the theft to the country.
Elliptic described the incident as potentially the largest known theft of any kind.
According to TRM Labs, the attackers gained control of Binance wallets and instructed them to transfer funds into wallets controlled by the hackers.
The technique reportedly bore similarities to the February 2025 attack on cryptocurrency exchange Bybit, which the FBI attributed to North Korean hackers.
TRM Labs said the latest incident was linked to North Korea’s elite hacking unit, although Binance said its investigation had not attributed responsibility to any individual.
North Korea has repeatedly been accused by US and South Korean authorities, as well as cybersecurity experts, of using state-linked cyber units to conduct espionage and steal funds to generate revenue. Pyongyang routinely denies such allegations.
Binance said an initial investigation suggested that the breach may have originated from a compromised laptop belonging to one of its engineers, allowing an attacker to gain access to an internal system and authorise unauthorised withdrawals.
“Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” the company said, adding that it had subsequently identified additional points of breach.
The exchange said it had set aside approximately $6.34bn in company funds to cover the losses, although it did not provide details about the source of the money.
Binance also operates a $1bn Secure Asset Fund for Users, designed to protect customers in the event of security breaches.
The company’s co-CEO, Richard Teng, assured customers that their funds were safe and that Binance would absorb the losses.
“Your money is safe and we’re covering every loss,” Teng said in a post on X.
Binance added that it was working with partners to freeze the affected assets, while several cryptocurrency companies have confirmed measures to block the movement of funds linked to the attack.
Tether, the world’s largest stablecoin issuer, said it had frozen nearly $1.57bn linked to the incident, while Circle froze more than $800m.
World Liberty Financial, a cryptocurrency venture backed by US President Donald Trump, also said it had worked with digital asset custodian BitGo to freeze some of the funds.
See also: Google, Meta, Microsoft Join Forces to Hunt Down West African Scammers
Binance co-founder Yi He disclosed that approximately $27m in stablecoins and $2m worth of World Liberty tokens had been frozen. Cryptocurrency company Ripple also froze about $200m linked to the theft, she said.
However, Binance did not provide a detailed account of the remaining $3.3bn that had not been located. It said it expected withdrawal services to resume within 48 hours.
The attack rattled cryptocurrency markets, with Bitcoin falling to a six-week low of $76,368, while Ethereum dropped more than three per cent to a two-month low of $2,178 before prices stabilised.
BNB, the token associated with Binance, also fell 5.3 per cent over 24 hours to $699.54, according to CoinGecko.
Analysts warned that the breach could further weaken investor confidence in centralised cryptocurrency exchanges, particularly as the digital asset market faces pressure from higher US interest rates and weaker demand from exchange-traded fund investors.
Tim Sun, a senior researcher at HashKey Group, said the incident could prompt investors to reassess the safety of assets held on centralised exchanges.
Binance, which enables users to buy, sell and trade digital assets, has approximately 335 million registered users worldwide and held about $162.8bn in assets under custody as of its 2025 annual report.
The incident adds to a growing list of major cryptocurrency thefts. Researchers at TRM Labs estimated that hackers stole $2.9bn in digital assets across nearly 150 attacks in 2025.
In September, cryptocurrency exchange Bitget also disclosed that approximately $350m in digital assets had been stolen from its platform.
Moody’s Ratings Vice President for Digital Assets, Cristiano Ventricelli, said the broader impact of the Binance breach would depend on the final losses, the recovery of stolen assets and whether the incident triggered wider disruption or a loss of confidence across the cryptocurrency industry.
About the Author
Cecilia Attah is a tech analyst with a degree from Benue State University. She covers tech news and startups at TechRegard with a focus on how technology is transforming Africa and shaping the global landscape.
