Hackers Steal $6.3 Billion From Binance in World's Biggest Crypto Heist

Binance says customer funds remain safe and pledges to cover losses, while stablecoin issuers freeze billions of dollars in assets linked to the incident.

Binance, the world’s largest cryptocurrency exchange, has reportedly suffered a $6.3 billion cyberattack, in what analysts have described as one of the largest cryptocurrency thefts in history. Blockchain analytics firms TRM Labs and Chainalysis have expressed high confidence that North Korea was behind the attack.

The incident triggered a broad decline in cryptocurrency markets, with investors reassessing the security of digital assets held on centralised exchanges. Binance temporarily halted withdrawals following the breach and said it would cover the losses using company funds and its security reserves.

The exchange said customer funds remained safe and that it was coordinating with law enforcement and industry partners to recover the stolen assets. Approximately $3 billion had reportedly been located or frozen, although the status of the remaining $3.3 billion was not immediately clear. Binance expected withdrawal services to resume within 45 hours of its announcement.

In a statement posted on X, Binance said the incident involved a complex attack and that its security teams were working with relevant authorities and partners to address the breach.

North Korea Suspected of Orchestrating the Attack

According to TRM Labs and Chainalysis, the attack shares similarities with previous major cryptocurrency thefts attributed to North Korean state-linked hacking groups, including the 2025 Bybit exchange hack, which the US Federal Bureau of Investigation attributed to North Korea.

TRM Labs said the attackers manipulated wallet transactions used by Binance, enabling funds to be transferred into wallets controlled by the hackers. The firm attributed the operation to North Korea’s elite hacking unit, while Chainalysis also expressed high confidence in North Korean involvement.

The bulk of the theft reportedly took place within approximately 20 minutes late on Thursday.

North Korea has previously been accused by US and South Korean authorities and cybersecurity researchers of using state-linked cyber operations to generate revenue through financial theft and espionage. The country routinely denies such allegations.

Compromised Engineer's Laptop May Have Enabled Breach

Binance's initial investigation indicated that the attack may have originated from a compromised laptop belonging to one of its engineers. The device may have provided attackers with access to an internal system, enabling unauthorised withdrawals.

The company said its security team was tracing the full attack path and subsequently identified additional potential points of compromise.

Mark Karpeles, former chief executive of the defunct Mt. Gox cryptocurrency exchange, suggested that attackers may have obtained private keys associated with at least two Binance wallets.

He noted that Binance appeared to have distributed its assets across multiple systems, limiting the potential impact of an individual security breach. However, the incident demonstrated that even segmented security infrastructure could be exposed to significant losses.

Tether, Circle and Ripple Freeze Billions in Assets

Several major cryptocurrency companies and stablecoin issuers have taken action to freeze assets connected to the incident.

Tether reportedly froze nearly $1.57 billion in associated assets, while Circle froze more than $800 million. World Liberty Financial also confirmed that it had worked with cryptocurrency custodian BitGo to freeze funds linked to the attack.

Binance co-founder Yi He said approximately $27 million in stablecoins and around $2 million worth of World Liberty tokens had also been frozen. Ripple reportedly froze approximately $200 million in related funds.

Binance operates its Secure Asset Fund for Users (SAFU), a $1 billion reserve designed to protect customers in the event of security breaches and other unexpected incidents. However, the reported $6.3 billion theft significantly exceeds the fund's stated value.

Binance co-CEO Richard Teng said that the exchange would use its own funds alongside available security reserves to cover the losses.

Cryptocurrency Markets Decline Following News

The reported attack triggered selling pressure across cryptocurrency markets.

Bitcoin fell to a six-week low of $76,368, while Ethereum declined more than 3% to approximately $2,178, reaching a two-month low before prices stabilised.

BNB, Binance's native ecosystem token, declined around 5% over a 24-hour period to $709.70, according to CoinGecko.

The broader market reaction also affected publicly traded companies with exposure to digital assets. Coinbase Global shares fell 4.8%, despite the exchange confirming that it was unaffected by the incident, while shares of Bitcoin-focused investment company Strategy declined nearly 6% in extended US trading.

Wider Implications for the Digital Asset Industry

The incident adds to growing concerns about cybersecurity risks across the cryptocurrency industry. According to TRM Labs, approximately $2.9 billion worth of cryptocurrency was stolen across nearly 150 attacks last year.

In September, cryptocurrency exchange Bitget also reported that approximately $350 million in digital assets had been stolen from its platform.

Binance, which reported 335 million registered users globally, held approximately $162.8 billion in assets under custody, according to its 2025 annual report.

Analysts warn that the consequences of the incident could extend beyond the immediate financial losses, potentially affecting investor confidence in centralised cryptocurrency exchanges and the wider digital asset ecosystem.

Tim Sun, senior researcher at Hong Kong-based HashKey Group, said the incident could further weaken investor risk appetite and prompt market participants to reassess the safety of assets held on centralised platforms.

Cristiano Ventricelli, Vice President of Digital Assets at Moody’s Ratings, said the broader implications would depend on the final financial losses, affected counterparties, asset recovery efforts and whether the incident triggers wider disruption or a loss of confidence across the digital asset industry.

As investigations continue, the scale of the reported breach and the response from Binance and its industry partners are likely to become an important test of cybersecurity preparedness, asset protection and institutional confidence in the global cryptocurrency market.

Note: The reported $6.3 billion theft, North Korean attribution and recovery figures are presented as claims from the supplied source, not independently verified facts.

Source: Zaywa