Binance, the world’s largest cryptocurrency exchange, has suffered a USD 6.3 billion hack, which analysts described as the biggest cryptocurrency theft in history.
Blockchain intelligence firms have linked the attack, which unfolded largely within approximately 20 minutes late on Thursday, to North Korea’s state-backed hacking operations.
The breach also sent cryptocurrency prices lower as investors reassessed the security of digital assets and the risks associated with holding funds on centralised exchanges.
Binance temporarily halted withdrawals following the incident and said it would cover all losses while working with cryptocurrency companies and other partners to freeze the stolen assets.
Blockchain analysis firms TRM Labs and Chainalysis said they were “highly confident” that North Korea was responsible for the attack, citing similarities with previous large-scale cryptocurrency thefts attributed to the country.
According to TRM Labs, the attackers were able to instruct wallets used by Binance to transfer assets into wallets controlled by hackers.
The method resembled the 2025 attack on cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation (FBI) attributed to Pyongyang.
“TRM attributes the attack to … North Korea’s elite hacking unit,” the blockchain analysis firm said in an assessment published on its website.
North Korea has repeatedly been accused by American and South Korean authorities, as well as cybersecurity researchers, of using state-linked cyber units to conduct espionage, steal financial assets, and generate revenue.
Binance said customer funds remained safe and that the company would assume responsibility for covering the losses arising from the security breach.
The exchange was working with external partners to freeze the affected cryptocurrency holdings, with approximately USD 3 billion located so far.
However, Binance did not provide an update on the remaining USD 3.3 billion that had not been located or frozen.
“Your money is safe and we’re covering every loss,” Binance co-CEO Richard Teng said in a post on popular micro-blogging platform X (formerly Twitter).
Teng added that the company’s investigation had not attributed responsibility to any individual.
Binance also operates a Secure Asset Fund for Users (SAFU), a reserve worth approximately USD 1 billion held entirely in bitcoin.
According to Binance’s website, the fund has been created with the goal of providing an additional layer of protection for customer assets in the event of security breaches.
Binance’s financial resources and the SAFU reserve could therefore play an important role in managing the consequences of the incident.
While the scale of the breach has raised questions about how hackers were able to gain access to the exchange’s systems despite its extensive security infrastructure, an initial investigation suggested that the attack may have originated from a compromised laptop belonging to one of Binance’s engineers.
According to the exchange, the hackers may have used access to the compromised computer to enter one of its systems and initiate unauthorised withdrawals.
“Our security team is tracing the full attack path through the compromised computer, which may be the entry point of the incident,” Binance said.
Mark Karpeles, the former chief executive of defunct Tokyo-based cryptocurrency exchange Mt Gox, told Reuters the attackers may have obtained access to private keys associated with at least two Binance wallets.
Mt Gox collapsed more than a decade ago after approximately USD 500 million worth of bitcoin was stolen, making it one of the most significant failures in the cryptocurrency industry’s history.
Karpeles said Binance appeared to have distributed its assets across multiple systems, limiting the potential damage from a single security breach.
“Binance appears to have split its assets across multiple systems, ensuring a hack can only affect a part of the assets, but even so a single hack is a large loss,” he said.
The investigation into the compromised computer and the movement of stolen cryptocurrency is expected to be important in determining the full extent of the breach and identifying potential weaknesses in Binance’s security arrangements.
The response from cryptocurrency companies and stablecoin issuers has helped Binance locate and restrict access to a substantial portion of the stolen funds.
Tether, the issuer of the world’s largest stablecoin, said it had frozen nearly USD 1.57 billion in assets linked to the incident.
Circle, another major stablecoin issuer, froze more than USD 800 million.
World Liberty Financial, the cryptocurrency venture backed by US President Donald Trump, also said it had worked with digital asset custodian BitGo to freeze funds associated with the attack.
Binance co-founder Yi He said approximately USD 27 million in stablecoins and another USD 2 million worth of World Liberty tokens had been frozen.
Cryptocurrency company Ripple also froze approximately USD 200 million in funds, according to Yi.
The coordinated response highlights the role that stablecoin issuers, custodians, and other industry participants can play in restricting the movement of stolen digital assets.
The Binance security breach triggered selling across cryptocurrency markets, with Bitcoin and Ethereum falling to multi-week lows before prices stabilised.
Bitcoin declined to USD 76,368, its lowest level in six weeks, while ether fell more than 3% to USD 2,178, marking a two-month low.
BNB, the token originally launched as Binance Coin and used by customers to pay transaction fees on the exchange, declined 5% over 24 hours to USD 709.70, according to CoinGecko.
The uncertainty also affected publicly traded companies with significant exposure to the cryptocurrency market.
Shares of Coinbase Global, another major cryptocurrency exchange that said it was unaffected by the breach, fell 4.8%. Shares of Strategy, one of the largest publicly traded corporate holders of bitcoin, declined nearly 6% in extended US trading.
Aravind Srinivasan of market maker GSR described the incident as the biggest hack in history as cryptocurrency prices fell.
The market reaction reflects concerns that the attack could weaken investor confidence in centralised cryptocurrency exchanges at a time when digital assets are already facing pressure from higher US interest rates and softer demand from exchange-traded fund investors.
Tim Sun, senior researcher at Hong Kong-based HashKey Group, said the breach could further weaken appetite for risk among cryptocurrency investors.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” Sun said.
The scale of the Binance breach is particularly significant given the exchange’s position in the global digital asset industry.
Binance had 335 million registered users worldwide and held approximately USD 162.8 billion in assets under custody, according to the exchange’s 2025 annual report.
The incident also adds to a growing list of major cryptocurrency thefts that have exposed vulnerabilities across trading platforms and digital asset infrastructure.
Researchers at TRM Labs estimated that attackers stole approximately USD 2.9 billion worth of cryptocurrency across nearly 150 attacks during the previous year.
In September, cryptocurrency exchange Bitget reported that approximately USD 350 million worth of digital assets had been stolen from its platform, further highlighting the security challenges facing the industry.