Hackers drained billions from the world’s largest crypto exchange in minutes, with blockchain researchers pointing to North Korea.
Hackers stole about $6.3 billion from Binance late Thursday in what ranks as the largest cryptocurrency theft on record, prompting the platform to freeze transfers while investigators trace the missing assets.
The exchange halted all deposits and withdrawals after the breach hit its main global platform, Binance.com, BBC News reported. Its separate American entity, Binance.us, wasn’t affected by the incident. Binance co-chief executive officer Richard Teng said the company will cover all customer losses, though the exchange warned that the total sum stolen could climb as forensic teams continue reviewing its systems.
How the breach unfolded
Most of the theft occurred across roughly 20 minutes on Thursday evening, according to blockchain analytics firms TRM Labs and Chainalysis, as reported by Al Jazeera. Attackers moved funds out of Binance wallets across 10 separate blockchains.
Binance’s early findings indicated the breach began with an employee’s compromised laptop. The company stated that the infected machine gave an unauthorized intruder access to an internal service container, which the attacker used to submit fraudulent withdrawal transactions. By Friday, Binance said it had found additional points of breach across its infrastructure, TechCrunch reported.
The exchange maintained it has seen no sign that private wallet keys were leaked. Former Mt. Gox head Mark Karpeles told Reuters that the attackers probably secured keys for at least two Binance wallets. Security analysts said the incident raises tough questions about how an engineer’s laptop held enough access to approve transactions worth billions of dollars.
Suspicions fall on North Korea
Several independent tracking firms quickly pointed to state-backed hackers in Pyongyang. TRM Labs assessed with high confidence that the assault was carried out by TraderTraitor, a unit tied to North Korea’s Lazarus Group. Blockchain firm Elliptic also blamed North Korean actors, noting that portions of the stolen crypto flowed into a digital wallet previously linked to a $351 million breach at the Bitget exchange earlier this year.
The Lazarus Group was previously blamed for the $1.5 billion hack of crypto exchange Bybit in February 2025, which had been the largest crypto theft until now. North Korea routinely denies taking part in cyberattacks. Teng said Binance’s internal investigation hasn’t yet pinned the attack on any specific individual or group.
Security researchers track North Korean cyber operations closely because stolen digital tokens help finance Pyongyang’s weapons programs. Ari Redbord, global head of policy at TRM Labs, told Al Jazeera, “That makes this a global security issue, not just a crypto theft.”
Market impact and recovered funds
About $3 billion of the stolen money has already been frozen, Binance said. That total includes more than $2.3 billion halted directly by stablecoin issuers Tether and Circle, though roughly $3.3 billion remains unaccounted for.
The sheer size of the attack rattled digital currency markets on Friday. Bitcoin dropped to a six-week low of $76,368 before finding its footing, and Ether sank more than 3 percent to hit a two-month low of $2,178. Shares of rival exchange Coinbase fell 4.8 percent even after it announced its systems were unaffected.
What happens next for users
Binance said Friday that it expects to resume customer withdrawals within 45 hours as it works with partner networks and law enforcement to secure its systems. The company promised to publish an updated proof of reserves once repairs are finished.
Covering the full shortfall will test Binance’s financial backstops. The stolen $6.3 billion is more than six times the size of the platform’s $1 billion emergency reserve fund, which was established in 2018 and is held in Bitcoin. Teng said Binance will pull from company cash to make up any difference that the reserve fund can’t cover.
Cybersecurity specialists also warned cryptocurrency owners to watch for follow-up scams. Security researchers cautioned that phishers often take advantage of such high-profile disruptions by sending fake support messages or directing users to move their coins to fraudulent safe wallets.
