Who could be behind the Binance hack and what we know so far

Binance, the world's largest cryptocurrency exchange, lost $6.3bn in what is believed to be the largest cryptocurrency hack on record. Co-chief executive Richard Teng said the attack began with a compromised DevOps engineer's laptop that gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions. Teng described it as a complex attack, not a one-click action, carried out by multiple hackers using sophisticated methods to hide their tracks including a self-destruct mechanism.

Some analytics firms have pointed to North Korea as a possible source, comparing elements of the attack to earlier incidents linked to the Lazarus Group, a cluster of cyber-criminals accused of working for the regime. North Korea has denied involvement. Binance has not directly responded to queries about potential North Korean links.

Binance said it will cover all losses from its emergency reserve and company funds. The company suspended deposits and withdrawals as a precaution and reported that around $3bn in affected assets had been located and frozen through partner cooperation. Binance.us, which serves US residents, said it was not affected.

Edward Howell, a North Korea expert at the University of Oxford, told the BBC that Pyongyang has a documented history of using cyber warfare to extract cash and that it "basically has a state-run cyber warfare agency" used to fund weapons programs and as a "slush fund" for leader Kim Jong Un's regime. Howell said 40 to 50 percent of North Korea's weapons programs are funded by cyber and cryptocurrency warfare.

Jennifer Craven, an international commercial fraud expert at law firm Pinsent Masons, said the incident exposes fragility in the cryptocurrency ecosystem and will likely accelerate regulatory scrutiny of how the sector protects infrastructure and customers.

Users of other crypto platforms have been warned to watch for phishing attempts exploiting the hack. NordVPN's chief technology officer Marijus Briedis advised verifying updates through the official Binance app or trusted websites and avoiding links in unsolicited messages.