Binance, the world's largest cryptocurrency exchange, says it has frozen approximately half of $6.3bn in digital assets stolen in what analytics firms link to a North Korean hacking unit. The company secured $3bn of the stolen funds, though many assets remain in unidentified hands, according to Binance co-CEO Richard Teng.
Binance initially believed a DevOps engineer's compromised laptop caused the breach. Subsequent investigation revealed a wider attack involving multiple points of breach and a self-destruct mechanism that destroyed hacker tools and traces, Teng said.
The hack eclipses a $1.5bn heist on Bybit exchange in 2025. Both incidents show similarities linked to North Korean-associated cyber criminals, according to TRM Labs and Chainalysis, which said it has "high confidence" in the North Korean connection.
The US Secret Service said it is "working around the clock" to identify, freeze, trace and recover stolen funds. Binance said the US-facing exchange was unaffected but that stolen assets included US-linked stablecoins Tether and Circle.
Binance told users "your money is safe, and we're covering every loss." The company initially suspended deposits and withdrawals, then said deposits remain unaffected. Daniel Tunkel of Edwin Coe law firm cautioned that customers should not regard Binance's coverage promise as legally binding and may need to pursue litigation based on their contract terms.
Several experts compared Binance's assurances to statements made by FTX CEO Sam Bankman-Fried before that exchange collapsed in 2022, causing substantial customer losses.