Binance, the world's largest cryptocurrency exchange, said on Thursday that $6.3bn in digital assets were compromised in what analytics firms have called the "largest hack in history." About half of those assets have been frozen with help from other platforms. Binance said it will cover all losses.
Early checks suggest an engineer's compromised laptop allowed the attacker to make unauthorised withdrawals, according to Binance. Two crypto analytics firms, TRM Labs and Chainalysis, attributed the incident to a North Korean hacking unit called TraderTraitor. Chainalysis said it has "high confidence" in the link. The hack exceeds a previous record of $1.5bn stolen from Bybit exchange in 2025.
Binance did not directly comment on North Korean links but said it is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
Binance co-chief executive Yi He said the platform has disabled withdrawals "until the environment is confirmed to be secure." The company disabled withdrawals on Binance.com. Its smaller U.S.-only platform, Binance.US, said it was unaffected.
Tether froze around $1.6bn in assets related to the hack. Circle froze more than $800m. World Liberty Financial, linked to U.S. President Donald Trump and his family, said it worked with partners to freeze stolen funds. Coinbase said it was unaffected and monitoring the situation.
TRM Labs' Ari Redbord told the BBC the hack is a "watershed moment" unlike anything the industry has seen. The attacker still holds an enormous sum of stolen assets, Redbord added. Bitcoin dropped more than 4% following alerts about the hack. Ethereum and Solana prices also fell sharply.