Binance, the world’s largest cryptocurrency exchange, has suffered a $6.3 billion security breach in what analysts described as the biggest cryptocurrency theft on record, raising fresh concerns about the safety of digital assets held on centralized trading platforms.
The attack triggered a broad decline in cryptocurrency prices, forced Binance to suspend withdrawals, and renewed scrutiny of the security systems used by exchanges to protect customer funds. The company said it would cover all losses, while several stablecoin issuers and cryptocurrency firms moved to freeze assets linked to the incident.
Blockchain analysis firms TRM Labs and Chainalysis attributed the attack to North Korea with a high degree of confidence, citing similarities with previous cyberattacks associated with the country. The bulk of the theft occurred within approximately 20 minutes late on Thursday.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
TRM said the attackers manipulated Binance’s wallet infrastructure to move funds into wallets under their control, an approach resembling the 2025 attack on cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korea.
“TRM attributes the attack to … North Korea’s elite hacking unit,” the firm said in an analysis published on its website. Chainalysis also expressed high confidence that North Korean actors were responsible.
North Korea has repeatedly been linked by US and South Korean authorities and cybersecurity researchers to cyber operations targeting financial institutions and cryptocurrency platforms. These operations have been associated with espionage, financial theft, and efforts to generate revenue for the state. Pyongyang routinely denies involvement in such activities.
Binance said customer funds remained safe and that it was working with industry partners to recover or freeze assets connected to the breach. The exchange said approximately $3 billion had been located, with stablecoin issuers including Tether, Circle and World Liberty Financial among the organizations involved in freezing the funds.
Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle reported freezing more than $800 million. World Liberty Financial said it had worked with cryptocurrency custodian BitGo to restrict the movement of funds.
Binance co-founder Yi He said that $27 million in stablecoins and approximately $2 million worth of World Liberty tokens had been frozen. Cryptocurrency company Ripple also froze roughly $200 million in funds, according to Yi.
The recovery effort highlights the unusual position of stablecoin issuers in the cryptocurrency ecosystem. Unlike decentralized cryptocurrencies such as Bitcoin, many stablecoins operate through issuers that can restrict or freeze tokens under certain circumstances. That capability allows companies to intervene when stolen assets are identified, although it does not guarantee that all funds can be recovered.
Binance did not provide details on the whereabouts of the remaining $3.3 billion. The company said it expected withdrawal services to resume within 48 hours.
“Your money is safe and we’re covering every loss,” Binance co-CEO Richard Teng said on X. He added that the company’s investigation had not attributed responsibility to any individual.
The scale of the theft has also raised questions about the adequacy of Binance’s existing financial safeguards. The exchange operates a Secure Asset Fund for Users, known as SAFU, a reserve valued at $1 billion and held entirely in Bitcoin. The fund is designed to protect users in the event of security breaches.
The $6.3 billion theft is substantially larger than that reserve, making Binance’s commitment to use company funds alongside its security fund important to reassuring customers. The company has not provided a detailed breakdown of how it intends to finance the full compensation.
Binance reported 335 million registered users globally and approximately $162.8 billion in assets under custody in its 2025 annual report. The scale of its operations means that any major security failure carries implications beyond the immediate financial loss, particularly for confidence in centralized exchanges.
Compromised Engineer’s Laptop as Possible Entry Point
Binance’s preliminary investigation indicated that the breach may have originated from a compromised laptop belonging to one of its engineers. The device may have allowed an attacker to access an internal system and initiate unauthorized withdrawals.
“Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” Binance said.
The company has not established the complete sequence of events or disclosed precisely how the attackers gained control of the systems involved.
Mark Karpeles, the former head of defunct Tokyo-based Bitcoin exchange Mt. Gox, said the attackers may have obtained private keys associated with at least two Binance wallets. Mt. Gox collapsed more than a decade ago after approximately $500 million worth of Bitcoin was stolen, making its failure one of the defining security incidents in cryptocurrency history.
Karpeles said Binance appeared to have distributed its assets across multiple systems to limit the damage a single breach could cause. However, he noted that the theft demonstrated how a compromise affecting even part of an exchange’s infrastructure could still result in enormous losses.
The incident also exposes the continuing risks associated with centralized custody. Exchanges hold or manage large quantities of customer assets, making their internal systems attractive targets for sophisticated cybercriminal groups. Security controls, private-key management and restrictions on transfers between wallets are therefore key to protecting funds.
Crypto Prices Fall as Investors Reassess Exchange Security
The theft added pressure to a cryptocurrency market already facing weaker risk appetite amid elevated US interest rates and softer demand from exchange-traded fund investors.
Bitcoin fell to a six-week low of $76,368, while Ether declined more than 3% to a two-month low of $2,178 before prices stabilized. BNB, the token originally launched as Binance Coin and used partly to pay trading fees on the exchange, fell 5% over 24 hours to $709.70, according to CoinGecko.
The sell-off also extended to publicly traded companies exposed to the cryptocurrency market. Coinbase Global, which said it was unaffected by the breach, lost 4.8%, while shares of Bitcoin-buying company Strategy fell nearly 6% in extended US trading.
The market reaction suggests that the consequences of the breach could extend beyond Binance’s direct financial exposure. Investors may become more cautious about keeping large cryptocurrency balances on centralized platforms, particularly if the investigation reveals weaknesses in internal access controls or wallet management.
Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said the incident could further weaken appetite for risk and prompt investors to reassess the security of assets held on centralized exchanges.
“It’s the biggest hack in history,” said Aravind Srinivasan of market maker GSR, as cryptocurrency prices declined broadly.
The theft also adds to a series of attacks targeting cryptocurrency platforms and digital asset holders. TRM Labs researchers estimated that attackers stole $2.9 billion in cryptocurrency across nearly 150 incidents last year. In September, exchange Bitget disclosed that approximately $350 million in cryptocurrency had been stolen from its platform.