Binance said Thursday that $6.3bn of digital assets were compromised in what multiple cyber-security firms believe is the largest cryptocurrency hack on record. The exchange said about half the stolen assets have been frozen, but many remain with hackers. Binance pledged to cover all losses.
Binance co-CEO Richard Teng said initial investigation pointed to a compromised engineer's laptop that gave attackers access to a service container for unauthorized withdrawals. He noted the attack involved a complex process beyond a single employee's permissions and found no evidence of wallet private key leaks. The company said subsequent investigation uncovered additional breach points but did not specify them.
Check Point, Chainalysis and TRM Labs attributed the attack to a North Korean hacking unit known as Lazarus Group or TraderTraitor. TRM Labs said the incident resembles earlier North Korean-linked hacks, including a $1.5bn breach of Bybit exchange in 2025. Check Point's security chief Jayant Dave said the losses made it "the largest crypto theft on record." The regime has previously denied involvement in hacks.
Binance said withdrawals remain disabled until security is confirmed. Tether and Circle froze approximately $2.4bn in response. Bitcoin dropped more than 4% after alerts of the breach circulated. Binance did not directly address the North Korea link but said it is working with law enforcement to identify the attackers. The company estimated it holds more than $160bn in assets under custody and has more than 300 million registered users worldwide.