Binance Suffers $6.3 Billion Crypto Hack in Biggest Attack on Record

Blockchain analysis firms TRM Labs and Chainalysis have linked the attack to North Korea. According to TRM Labs, the hackers targeted Binance wallets across 10 blockchains and transferred most of the stolen funds within about 20 minutes.

Binance said it had worked with industry partners to freeze the affected assets, recovering control of around $3 billion so far. The exchange did not clarify the status of the remaining $3.3 billion.

Binance co-founder Yi He said the company would cover all losses resulting from the hack.

The exchange added that customer deposits were not affected and that withdrawal services were expected to resume within 48 hours.

TRM Labs said several features of the attack resembled previous cyberattacks attributed to North Korea, including the 2025 hack of cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation linked to Pyongyang.

"We make this judgment with high confidence," the firm said.

North Korea's diplomatic mission in Geneva and its embassy in China did not immediately respond to requests for comment from Reuters.

Chainalysis and other industry experts said the incident could become the largest cryptocurrency theft in history.

"It's the biggest hack in history," said Aravind Srinivasan, head of the systematic over-the-counter business at cryptocurrency market maker GSR.

Crypto markets react to the attack

The news triggered a decline in cryptocurrency prices during Asian trading on Friday.

Bitcoin fell by more than 3% to a six-week low of $76,368, while Ether dropped by more than 3% to a two-month low of $2,178.

BNB, a cryptocurrency originally launched as Binance Coin and used to pay transaction fees on the exchange, fell 5% over 24 hours to $709.70, according to CoinGecko.

Shares of US cryptocurrency exchange Coinbase Global dropped 4.8%, while those of Bitcoin investment firm Strategy fell nearly 6% in extended trading.

Hacked laptop may have enabled breach

Binance's initial investigation suggests that the attack may have started with a compromised laptop belonging to one of its engineers.

The breach reportedly allowed hackers to gain access to an internal system and make unauthorised withdrawals.

"The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer, which may be the entry point of the incident," Binance said.

Analysts warned that the attack could further weaken confidence in the cryptocurrency market, which has already faced pressure from higher US interest rates and reduced demand from exchange-traded fund investors.

Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said the incident could make investors reconsider the safety of assets held on centralised exchanges, as well as the risks associated with their financial stability and liquidity.

Binance has 335 million registered users worldwide and held approximately $162.8 billion in customer assets, according to its 2025 annual report.

The exchange maintained that customer funds remained safe.

Crypto firms freeze stolen funds

Binance operates a Secure Asset Fund for Users, a reserve held entirely in Bitcoin and designed to protect customer assets in the event of security breaches.

Meanwhile, several cryptocurrency companies have taken steps to freeze funds linked to the attack.

Stablecoin issuer Tether said it had frozen nearly $1.57 billion in related assets, while Circle froze more than $800 million.

World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said it had worked with digital asset custodian BitGo to freeze funds stolen in the Binance attack.

Yi He said approximately $27 million in stablecoins and around $2 million worth of World Liberty tokens had been frozen.

Cryptocurrency company Ripple also froze approximately $200 million in funds, according to Yi. Ripple's senior vice-president of stablecoins, Jack McDonald, said the company was monitoring reports of the attack and coordinating with relevant parties.

Bernardo Brites, chief executive of payments and stablecoin infrastructure company Trace Finance, said artificial intelligence could make it increasingly difficult for cryptocurrency platforms to prevent cyberattacks by identifying security weaknesses faster than companies can fix them.

He suggested that users might move away from smaller and medium-sized exchanges because of concerns about their ability to cover major losses.

Growing concerns over cryptocurrency theft

The Binance incident adds to a series of major cryptocurrency thefts targeting digital asset platforms.

Researchers at TRM Labs said hackers stole $2.9 billion worth of cryptocurrency in nearly 150 attacks last year.

In September, cryptocurrency exchange Bitget reported that approximately $350 million in digital assets had been stolen from its platform.

Authorities have also warned that organised criminal groups are increasingly using cryptocurrencies to transfer money across borders outside traditional financial systems.

Binance.US, a separate exchange operating under the Binance name, said it was not affected by the incident. Coinbase also confirmed that its platform remained unaffected and that it was monitoring developments.

In a separate incident on Thursday, prediction market platform Polymarket temporarily suspended trading following a security breach involving a third-party service provider. The platform later resumed trading and said it would fully reimburse affected users.