On Thursday, cryptocurrency powerhouse Binance announced that it has been affected by a massive hack involving approximately $6.3 billion (£4.7 billion) worth of digital assets. This incident could potentially be the most significant breach in the history of cryptocurrency. The exchange stated that around half of the compromised assets have been frozen, while the remainder remains in the possession of the hackers. Binance assured users that it would cover all losses incurred.
Initial investigations suggest that the breach may have originated from a compromised engineer’s laptop, which enabled unauthorized withdrawals. Two analytics firms have linked the attack to a North Korean hacking group known as TraderTraitor. TRM Labs, an AI-driven investigative company, noted in a report that several characteristics of the Binance breach mirror previous North Korean-related incidents, including a notable $1.5 billion hack on the Bybit exchange in 2025.
Ari Redbord, the global head of policy at TRM Labs, described the Binance hack as a “watershed moment” for the industry, emphasizing its unprecedented nature. The attacker still retains a significant amount of stolen assets, complicating efforts to trace and retrieve the funds, according to Redbord.
Chainalysis, another prominent crypto analytics firm, expressed high confidence in the connection between the North Korean group and the hack. North Korean operatives have increasingly targeted cryptocurrency firms in recent years, resulting in substantial thefts of digital tokens. Western security agencies have previously indicated that the proceeds from these hacks are often funneled into financing North Korea’s nuclear weapons and missile development initiatives, although the regime has consistently denied involvement in such activities.
Eric Jardine, Head of Research at Chainalysis, urged crypto exchanges to maintain heightened vigilance, as they remain attractive targets for hackers due to the vast value of their assets. Binance has not directly addressed inquiries regarding potential ties to North Korea but stated, “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.” The breach specifically pertains to Binance.com, while the smaller Binance.US platform, catering to American users, reported no impact.
In a series of social media updates, Yi He, Binance’s co-CEO, expressed gratitude to various cryptocurrency issuers for their swift actions in freezing assets. “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,” she stated. Other major platforms, including Tether and Circle, have frozen a combined total of approximately $2.4 billion in assets in response to the potential hack. Circle’s CEO, Jeremy Allaire, mentioned that his company has frozen over $800 million linked to the incident, while Tether’s CEO, Paolo Ardoino, confirmed a freeze of around $1.6 billion from his platform, which issues the USDT cryptocurrency.
World Liberty Financial, a crypto entity associated with former President Donald Trump and his family, has collaborated with partners to freeze stolen funds. Meanwhile, Coinbase has stated that it remains unaffected by the incident but is closely monitoring the situation. Prior to Binance’s confirmation of the security issue, several industry observers had already raised alarms about a possible hack.
Founded in China in 2017, Binance enables users to trade a variety of digital assets and is estimated to have over 300 million registered users globally. The exchange has faced regulatory scrutiny across multiple jurisdictions. In 2024, the company reported holding more than $160 billion in assets under custody. Following the alerts regarding the hack, Bitcoin saw a decline of over 4%, with other major cryptocurrencies like Ethereum and Solana also experiencing significant drops.
