North Korean hackers blamed for $6.3 billion Binance theft

Hackers stole $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts say is the biggest crypto hack ever. TRM Labs and Chainalysis linked the attack to North Korea with high confidence. Binance said deposits were unaffected and it will cover all hacking losses.

Attack details and recovery

The attackers targeted Binance wallets on 10 blockchains and shifted most of the funds in about 20 minutes, TRM Labs said. Binance said it worked with partners to freeze affected assets, with about $3 billion located so far. It did not mention the status of the remaining $3.3 billion. An initial investigation suggested the breach may have started with a hacked laptop belonging to one of its engineers, which let an attacker gain access to one of its systems and make unauthorized withdrawals. Binance said deposits were unaffected and it expects to resume withdrawal services in the next 48 hours. Binance co-founder Yi He said the exchange would cover all hacking losses.

North Korea link and market reaction

TRM Labs said several features of the attack matched earlier heists linked to North Korea, including a 2025 hack of crypto exchange Bybit that the US Federal Bureau of Investigation had attributed to Pyongyang. It said it made the judgment with high confidence. North Korea's mission in Geneva and its embassy in China did not immediately respond to Reuters requests for comment. Markets reacted in Asian trading on Friday. Bitcoin dropped more than 3% to a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178. BNB was down 5% over the past 24 hours at $709.70. Shares in Coinbase Global slid 4.8% while those of bitcoin buyer Strategy fell nearly 6% in extended US trading.

Industry response and security context

Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million. World Liberty Financial said it had worked with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack. Binance's Yi said $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen. Crypto firm Ripple also froze roughly $200 million in funds, and Jack McDonald, senior vice president of stablecoins at Ripple, said the company was closely monitoring reports of a potential exploit involving Binance. Bernardo Brites, CEO of Trace Finance, said it is becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them. Tim Sun, senior researcher at HashKey Group, said the incident may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks. Binance has 335 million registered users globally and had about $162.8 billion in assets under custody as of the exchange's 2025 annual report. Binance runs a secure asset fund for users, a reserve held entirely in bitcoin that is intended to protect user assets in cases of security breaches, according to its website. The incident adds to a string of crypto thefts: last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to TRM Labs, and in September cryptocurrency exchange Bitget said roughly $350 million in crypto had been stolen from its platform. Binance.US said it was not affected by the security incident, while Coinbase said it was unaffected and was monitoring the situation. In an unrelated incident earlier on Thursday, prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider, then resumed trading and said it would fully reimburse affected traders.

Earlier coverage: Binance investigates suspected hack as outflows reach up to $5.8 billion

Sources: Cybernews · The Hacker News · Techmeme