Binance, the world's largest cryptocurrency exchange, said Thursday that $6.3bn of digital assets were affected in what is believed to be the biggest crypto theft on record, eclipsing a $1.5bn hack on rival exchange Bybit in 2025. The company said roughly half of the stolen assets have since been frozen, but a large sum remains in the attacker's hands.
Binance said early checks suggest the breach began with a compromised engineer's laptop. Co-chief executive Richard Teng said in a statement that the access "gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions," stressing that "this was not a single 'one-click' action" and that no wallet private keys are known to have leaked. A detailed post-mortem will follow once the investigation concludes, he said.
North Korea's Fingerprints
Two cybersecurity firms have attributed the attack to a North Korean hacking unit known as TraderTraitor, more widely identified in the industry as the Lazarus Group, which was also blamed for the 2025 Bybit hack. Check Point's chief information security officer, Jayant Dave, called the losses "the largest crypto theft on record," and noted the attack resembled a smaller September hack on exchange Bitget that cost $388m: "This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them." Chainalysis said separately it has "high confidence" the same North Korean group is responsible, while TRM Labs' global head of policy, Ari Redbord, called the breach "a watershed moment" unlike anything the industry has seen, warning that efforts to trace and recover the funds are far from over.
Western security agencies have long said North Korea uses proceeds from crypto thefts to help fund its nuclear weapons and missile programs; Pyongyang has denied involvement in hacks in the past, and Binance said it did not directly respond to questions about a North Korean link but is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
The incident affects only Binance.com; Binance.US, the smaller platform serving American customers, said it was not affected. Two other major stablecoin issuers, Tether and Circle, said they had jointly frozen roughly $2.4bn in assets linked to the hack, while World Liberty Financial, a crypto venture tied to President Trump and his family, said it had worked with partners to help freeze stolen funds. Binance said withdrawals remain disabled "until the environment is confirmed to be secure."
