Hackers have stolen an estimated $6.3 billion in cryptocurrency from Binance, the world's largest cryptocurrency exchange, in what blockchain investigators describe as the biggest cryptocurrency theft on record.
The attack unfolded on Thursday and triggered a frantic effort by Binance, stablecoin issuers, blockchain investigators and law-enforcement partners to trace and freeze the stolen assets. About $3 billion of the affected cryptocurrency had been located and frozen, according to Binance and companies assisting with the investigation.
Several blockchain intelligence firms have pointed to North Korea as the likely perpetrator, although Binance has not publicly attributed responsibility to any individual or government and the investigation remains ongoing. TRM Labs and Chainalysis both said they had high confidence that North Korea was behind the attack.
North Korea has previously denied allegations that it conducts state-sponsored cryptocurrency theft. CNN said it contacted North Korea's mission to the United Nations for comment.
Binance Hit in Largest Crypto Theft on Record
The stolen assets were taken from digital wallets controlled by Binance, rather than representing a conventional theft of cryptocurrency directly from individual users' wallets.
Binance said its initial investigation indicated that an attacker may have compromised a laptop belonging to one of its engineers. The compromised computer apparently provided access to a service container that allowed the attacker to submit unauthorised withdrawal transactions.
The exchange later said investigators had identified additional points of compromise as they continued tracing the attack.
The bulk of the theft reportedly took place in roughly 20 minutes.
The scale immediately surpassed the previous record for a cryptocurrency exchange hack: the approximately $1.5 billion theft from Bybit in 2025, which US authorities attributed to North Korea.
The latest incident is therefore more than four times the size of the previous record.
Binance Suspends Withdrawals
Following the discovery of the breach, Binance temporarily suspended deposits and withdrawals while it carried out security checks.
The company said it had revoked the affected address authorisation and was working with law-enforcement agencies and blockchain intelligence companies to trace the funds.
Binance also sought to reassure customers that their own funds remained safe.
The exchange said it would cover the losses using company funds and its emergency asset-protection arrangements. Binance co-CEO Richard Teng said customers would not be left to absorb the losses.
Binance was expecting withdrawal services to resume within about 45 hours, although the company did not initially provide a final figure for how much of the $6.3 billion remained unrecovered.
The company has a Secure Asset Fund for Users, known as SAFU, which includes a reserve intended to protect customers during major security incidents.
However, the estimated size of this latest attack is substantially larger than the fund's reported $1 billion bitcoin reserve.
About $3 Billion Already Frozen
The response from other cryptocurrency companies began almost immediately.
Stablecoin issuers Tether and Circle froze significant amounts of assets connected to the attack.
Tether said it had frozen almost $1.57 billion in assets linked to the incident, while Circle froze more than $800 million. World Liberty Financial also worked with custodian BitGo to freeze funds connected to the attack.
Binance co-founder Yi He said additional amounts had been frozen, including approximately $27 million in stablecoins and about $2 million worth of World Liberty tokens.
Crypto company Ripple also froze roughly $200 million connected to the incident, according to Yi.
The ability to freeze some stolen cryptocurrency demonstrates one of the unusual characteristics of blockchain-based financial crime: transactions can be publicly tracked, even though the identities behind wallet addresses may not immediately be known.
Investigators can monitor the movement of the assets across different blockchains and alert exchanges, stablecoin issuers and other companies when stolen funds enter their systems.
Investigators Point to North Korea
The most significant development in the investigation has been the emerging attribution to North Korea.
TRM Labs, a blockchain intelligence company, said it had high confidence that a North Korean hacking unit was responsible.
The company linked the attack to TraderTraitor, a North Korean cyber unit that investigators associate with the broader Lazarus Group.
Chainalysis also said it had high confidence in the North Korean attribution.
Pangolin Intelligence, another blockchain investigation firm, separately said its analysis pointed to a North Korean hacking unit.
Investigators said the methods used in the Binance attack showed similarities with previous North Korean-linked cryptocurrency thefts, including the 2025 Bybit attack.
TRM said the attackers were able to manipulate wallets used by Binance and move funds into wallets controlled by the hackers.
That similarity is one of the reasons investigators have connected the incident to North Korean cyber operations.
However, the attribution remains an investigative conclusion rather than a court-established finding.
Binance itself has said its investigation has not attributed responsibility to an individual.
North Korea Has Been Accused of Crypto Theft Before
North Korea has long been accused by the United States, South Korea and cybersecurity researchers of using sophisticated cyber operations to steal cryptocurrency and other financial assets.
The alleged thefts are significant because cryptocurrency has become a source of hard currency for a country facing extensive international sanctions.
US and South Korean officials have previously linked North Korean cyber groups to attacks on cryptocurrency exchanges, financial institutions and other organisations.
The Lazarus Group has been associated with some of the most prominent cryptocurrency thefts of recent years.
The FBI previously attributed the $1.5 billion Bybit theft to North Korea.
North Korean authorities have repeatedly rejected allegations that the government is responsible for such attacks.
As of the latest reports, there has been no public claim of responsibility for the Binance breach.
The Attack Has Shaken Cryptocurrency Markets
The unprecedented size of the theft immediately affected cryptocurrency markets.
Bitcoin fell to around $76,368, its lowest level in six weeks, while Ether dropped more than 3% to approximately $2,178, a two-month low. Binance's BNB token also declined, while shares of publicly traded cryptocurrency-related companies came under pressure.
Coinbase shares fell about 4.8%, while shares of Strategy, the major corporate holder of bitcoin, dropped nearly 6% in extended US trading.
The market losses were not solely attributable to the Binance incident, however, as digital assets were already facing broader pressure from financial-market conditions.
Still, analysts warned that the attack could make investors reconsider the risks associated with keeping cryptocurrency on centralised exchanges.
Tim Sun, a senior researcher at HashKey Group, said the incident could dampen risk appetite and cause investors to reassess the safety of assets held on centralised exchanges.
Why Centralised Exchanges Remain Vulnerable
The Binance attack has also renewed questions about the security model used by centralised cryptocurrency exchanges.
Unlike self-custody arrangements, where users directly control their private keys, centralised exchanges hold large quantities of digital assets on behalf of their customers.
That creates an attractive target for attackers.
A successful compromise of an exchange's internal systems can potentially provide access to enormous pools of digital assets.
In this case, investigators believe the initial access may have come through an employee's compromised laptop rather than through a direct breach of Binance's blockchain infrastructure.
Binance said there was no indication that customer wallet private keys had been leaked, and the company maintained that user funds were safe.
The distinction is important: the reported $6.3 billion figure represents the estimated impact of the security incident, while Binance's customer-protection statements indicate that customers are not expected to bear the loss.
Recovery Efforts Continue
Tracing the stolen assets will likely take considerable time.
Cryptocurrency can be moved quickly between wallets and across multiple blockchains. Investigators must therefore track the funds as they move while attempting to prevent the hackers from converting them into assets or currencies that are more difficult to recover.
According to Chainalysis, stolen funds were already moving across multiple blockchain networks, including Bitcoin and Ethereum.
Stablecoins provide investigators with another potential intervention point because their issuers can sometimes freeze tokens associated with known criminal activity.
That mechanism has already allowed companies to immobilise a significant portion of the affected assets.
But the remaining funds could prove much more difficult to recover if they are moved through multiple wallets, decentralised protocols or other services.
A Major Test for Binance
The attack represents a major security and reputational challenge for Binance.
The exchange reported approximately 335 million registered users globally and about $162.8 billion in assets under custody in its 2025 annual report, according to Reuters.
That scale makes Binance one of the most important institutions in the cryptocurrency industry.
The company's decision to cover the losses is intended to prevent the breach from becoming a direct financial disaster for customers.
But the incident could still have longer-term consequences if users become concerned about the security of centralised exchanges.
Cristiano Ventricelli, vice president for digital assets at Moody's Ratings, said the wider implications would depend on the final losses, affected counterparties, asset recovery and whether the incident causes broader disruption or a loss of confidence across the digital-asset ecosystem.
The Biggest Crypto Heist Yet
The Binance breach has fundamentally changed the scale of cryptocurrency theft.
The previous record-setting Bybit attack involved approximately $1.5 billion.
The estimated $6.3 billion Binance incident is more than four times larger, according to current estimates.
Yet the final amount lost may still change as investigators complete their analysis.
Binance initially described the incident as a potential security breach, while independent investigators and blockchain analysts have characterised it as a record cryptocurrency heist.
For now, about half of the affected assets have been located or frozen, while the fate of roughly $3.3 billion remains unclear.
The investigation will determine not only how the attackers entered Binance's systems but also how they were able to move such a large amount of cryptocurrency so quickly.
The emerging North Korean attribution has also placed the incident within a much wider pattern of alleged state-linked cryptocurrency theft.
For Binance, the immediate priority is recovering the remaining funds and restoring normal services.
For the wider cryptocurrency industry, the attack presents a much bigger question: if billions of dollars can be moved from one of the world's largest exchanges in minutes, how secure are the institutions holding the industry's digital wealth?
