Binance hit by $6.3bn hack: analysts point to North Korean hackers

Binance, which analysts describe as the world's largest cryptocurrency exchange, has revealed the impact of a cyberattack in recent days. The estimated value of the affected assets is around $6.3bn. The industry is calling it the biggest crypto theft in history.

How the attack unfolded

According to analytics firm TRM Labs, the attackers took over Binance wallets across 10 blockchain networks. They moved most of the funds out in about 20 minutes. Chainalysis confirmed the theft of at least $5.912bn, and the final scale is estimated at $6.3bn (TRM puts it at about $6.36bn).

Initial findings from the exchange suggest the breach may have come through a compromised laptop belonging to one of its engineers. This gave the attacker access to its systems and allowed unauthorised withdrawals. Binance temporarily suspended deposits and withdrawals until its security review is complete. Reports said they were due to resume within 48 hours.

Who is behind it

TRM Labs attributes the attack to a North Korean group called TraderTraitor. It said it made the assessment with high confidence, citing credible on-chain and off-chain intelligence. Chainalysis reached similar conclusions. TRM analysts note that features of the attack resemble earlier hacks linked to North Korea, including the theft from the Bybit exchange in February 2025. That attack, worth $1.5bn, was attributed by the US FBI to Pyongyang. However, these are assessments by analytics firms, not findings by law enforcement.

Frozen funds and losses

Binance said that, together with partners, it had frozen about $3bn in assets on-chain. Stablecoin issuers were involved: Tether blocked about $1.6bn, and Circle, the provider of USDC, froze about $800m in cooperation with the authorities. The company World Liberty Financial also offered help.

The exchange says it will cover the losses from its SAFU reserve fund and its own money, and that user funds are safe. It also promised to publish an updated proof of reserves once remediation is complete. Binance co-founder Yi He pledged that the company would cover all losses from the breach.

Cryptocurrency prices fell after the attack was disclosed. According to the Polish site money.pl, bitcoin dropped below $77,000.

What this means for you

Nothing in the available information suggests the attack affected specific customers in the UK. People who hold cryptocurrency on Binance should watch the exchange's announcements about the resumption of withdrawals and the state of its reserves. It is also worth being wary of messages impersonating the exchange, which can appear in situations like this. That is general advice, not a finding from the sources.