Binance Says $6.3bn of Assets Hit in Record Crypto Hack

Binance said on Thursday that $6.3bn (£4.7bn) of digital assets were affected by what is thought to be the biggest crypto hack on record. The exchange said about half of that sum has been frozen. Much of the rest remains in the hands of the hackers. Binance says it will "cover all losses".

Binance is the world's biggest crypto exchange. The previous record for a hack was $1.5bn, taken from the Bybit exchange in 2025.

How the attack happened

Co-chief executive Richard Teng said early checks pointed to a compromised engineer's laptop. That gave an attacker access to a service container, where unauthorised withdrawal transactions were submitted. He stressed that the attacker "did not simply use one engineer's permissions" and that it was not a single "one-click" action. Binance has found no evidence of a wallet private key leak.

A later update said a further investigation had found other points of breach. "We are still gathering the facts, and will share more directly as we have them," the company wrote on X. A detailed post-mortem is promised once the investigation ends. Withdrawals are disabled until the environment is confirmed to be secure, co-chief executive Yi He said.

The incident concerns Binance.com. The smaller Binance.US, which serves American residents, said it was not affected. Coinbase said it was unaffected and was monitoring the situation.

North Korea link

Two analytics firms attribute the attack to a North Korean hacking unit called TraderTraitor. Check Point says the unit is also known as Lazarus Group, which was blamed for the 2025 Bybit theft. Chainalysis said it has "high confidence" in the link. TRM Labs said several elements of the attack resemble earlier North Korean-linked incidents.

Binance did not directly answer questions about a possible North Korean link, saying it was working with law enforcement to identify the culprits. North Korea's regime has denied involvement in hacks in the past. Crypto firms have been a main target for North Korea-linked operatives in recent years, and Western security agencies have previously said the proceeds finance the country's nuclear weapons and missile development programs.

Check Point's chief information security officer Jayant Dave called it "the largest crypto theft on record". He compared the attack with the September hack of the Bitget exchange, which cost $388m. In his words, attackers "no longer need the vault keys" and instead "target the systems and people with authority to use them".

TRM Labs policy head Ari Redbord described a "watershed moment". He said the attacker still holds an enormous sum, so efforts to trace and recover the money are far from over.

Tether and Circle said they had frozen about $2.4bn in total. World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it had worked with partners to freeze stolen funds.

Several industry observers had flagged concerns about a possible Binance hack hours before the exchange confirmed the problem. Bitcoin fell by more than 4% after the alerts, and Ethereum and Solana also dropped sharply.

Binance was founded in China in 2017 and is estimated to have more than 300 million registered users. It said in 2024 that it held more than $160bn in assets.

Source: BBC News