Key Takeaways
- • Binance disclosed that $6.3bn (£4.7bn) in digital assets has been impacted by what is thought to be the largest crypto hack on record, exceeding the $1.5bn Bybit exchange hack in 2025.
- • Roughly half of the affected assets have been frozen, while a substantial portion remains in the hands of the attackers, according to the BBC.
- • Two analytics firms, Check Point and TRM Labs, along with Chainalysis, have attributed the attack to North Korean hacking unit TraderTraitor, also known as Lazarus Group.
- • Binance said it will "cover all losses" and has disabled withdrawals until its environment is confirmed secure, while a detailed post-mortem is pending.
- • Tether and Circle reportedly froze a combined approximately $2.4bn in assets in response to the incident, and Bitcoin fell more than 4% after initial alerts.
Summary
Cryptocurrency exchange Binance said on Thursday that $6.3bn (£4.7bn) of digital assets had been impacted by what is thought to be the biggest crypto hack on record, according to the BBC. The world's largest crypto exchange said about half of the affected assets had been frozen, but many remained in the hands of the hackers. The company said it would "cover all losses."
Binance's co-CEO Richard Teng said the investigation initially suggested the attack began with a compromised engineer's laptop, which gave an attacker access to a service container where unauthorized withdrawal transactions were submitted. He stated that the attack was not a single "one-click" action and involved a more complex process, and that no evidence of a wallet private key leak had been found so far. Binance later said further investigation had identified additional points of breach, and that it was still gathering facts. Binance has not attributed responsibility to any individual.
Two analytics firms have attributed the incident to TraderTraitor, a North Korean hacking unit also known in the industry as Lazarus Group. Check Point's chief information security officer Jayant Dave described the estimated losses as "the largest crypto theft on record" and noted similarities to the September attack on Bitget, in which $388m was lost. TRM Labs said several elements resemble earlier North Korean-linked incidents, and its global head of policy Ari Redbord called the hack a "watershed moment." Chainalysis also said it had "high confidence" in the North Korean link. Binance did not directly respond to questions about North Korean involvement, stating only that it was working with law enforcement partners.
Tether and Circle said they had frozen a total of about $2.4bn in assets in connection with the incident. World Liberty Financial said it had worked with partners to freeze stolen funds. Coinbase said it was unaffected. Binance has more than 300 million registered users and said in 2024 it held over $160bn in assets under custody. Binance.US said its platform was not affected. Bitcoin dropped more than 4% following early alerts, with Ethereum and Solana also falling sharply.
Binance's co-CEO Richard Teng said the investigation initially suggested the attack began with a compromised engineer's laptop, which gave an attacker access to a service container where unauthorized withdrawal transactions were submitted. He stated that the attack was not a single "one-click" action and involved a more complex process, and that no evidence of a wallet private key leak had been found so far. Binance later said further investigation had identified additional points of breach, and that it was still gathering facts. Binance has not attributed responsibility to any individual.
Two analytics firms have attributed the incident to TraderTraitor, a North Korean hacking unit also known in the industry as Lazarus Group. Check Point's chief information security officer Jayant Dave described the estimated losses as "the largest crypto theft on record" and noted similarities to the September attack on Bitget, in which $388m was lost. TRM Labs said several elements resemble earlier North Korean-linked incidents, and its global head of policy Ari Redbord called the hack a "watershed moment." Chainalysis also said it had "high confidence" in the North Korean link. Binance did not directly respond to questions about North Korean involvement, stating only that it was working with law enforcement partners.
Tether and Circle said they had frozen a total of about $2.4bn in assets in connection with the incident. World Liberty Financial said it had worked with partners to freeze stolen funds. Coinbase said it was unaffected. Binance has more than 300 million registered users and said in 2024 it held over $160bn in assets under custody. Binance.US said its platform was not affected. Bitcoin dropped more than 4% following early alerts, with Ethereum and Solana also falling sharply.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.