Binance, the world’s largest cryptocurrency exchange, has frozen around half of the funds stolen in a major cyber attack after hackers accessed an estimated $6.3bn (£4.7bn) in what is believed to be a record cryptocurrency heist.
The exchange confirmed that it had secured $3bn in stolen digital assets, while a substantial portion remained in the hands of unidentified hackers, reports BBC.
Initial investigations suggested that the breach may have originated from a compromised laptop belonging to a DevOps engineer, allowing unauthorised withdrawals. However, further inquiries revealed a much wider attack.
Binance Co-Chief Executive Officer Richard Teng said the operation was not carried out by a single individual. Investigators found additional points of breach and a self-destruct mechanism that the hackers used to erase their tools and traces, making forensic investigations significantly more difficult.
Several blockchain analytics firms have linked the attack to a North Korean hacking unit. Cryptocurrency analytics firm Chainalysis expressed “high confidence” in North Korean involvement, noting that the breach surpassed the previous record of $1.5bn (£1.12bn) stolen from the Bybit exchange in 2025.
AI-powered investigations firm TRM Labs also found similarities between the attack and previous cyber incidents linked to Pyongyang, including the Bybit breach.
Investigators have attributed systematic cyber thefts targeting the digital asset sector over the past five years to North Korean state-backed hacking groups, particularly the Lazarus Group, also known as TraderTraitor.
Although Pyongyang has consistently denied responsibility, cryptocurrency flow analysis and interviews with defectors indicate that North Korea is likely the only country using cyber crime to raise public funds, circumvent international sanctions and support its struggling economy.
International law enforcement agencies have launched recovery efforts following the heist. The US Secret Service, America’s lead federal agency for financial crimes, said it was “working around the clock” to “identify, freeze, trace, and recover” the stolen funds and bring those responsible to justice.
Binance also confirmed that it was working directly with the Federal Bureau of Investigation (FBI).
Although the exchange said its US-facing platform was unaffected, US authorities can investigate and track the stolen assets because the breach involved dollar-pegged stablecoins linked to US companies, including Tether and Circle.
Seeking to reassure affected customers, Binance told users that “your money is safe, and we’re covering every loss”.
The exchange initially suspended all deposits and withdrawals but later informed customers that “deposits remain unaffected”.
Binance also revealed that it had “set aside” more than $6.34bn in corporate funds to cover the stolen assets and was “actively buying” various cryptocurrency tokens.
Despite these assurances, concerns remain among users and the wider cryptocurrency industry over whether Binance can absorb such a substantial financial loss.
Online observers have compared the exchange’s public assurances with statements made by former FTX chief executive Sam Bankman-Fried before the platform collapsed in 2022.
Legal experts have also warned customers against treating Binance’s promises as legally binding, saying any recovery could require formal legal action.
Daniel Tunkel of London-based law firm Edwin Coe said customers’ options would depend on their contractual terms and the jurisdictions in which they could sue Binance for failing to meet its obligations.
The incident adds to the ongoing regulatory scrutiny facing the exchange worldwide.
News of the record-breaking breach unsettled cryptocurrency markets during Friday trading in New York, pushing Bitcoin down 5% to $76,800.
Shares in cryptocurrency exchange operator Coinbase fell 12% after its quarterly revenue came in slightly below expectations, while financial services provider Robinhood dropped 7.8%.
Founded in China in 2017, Binance has an estimated 300 million registered users worldwide. The exchange reported managing more than $160bn in assets under custody in 2024.
