Key Takeaways
- • Binance, the world's largest crypto exchange, suffered an industry-record hack of $6.3bn (£4.7bn), with about $3bn of affected assets frozen so far and no update given on the remaining $3.3bn.
- • TRM and Chainalysis attribute the attack with high confidence to TraderTraitor, North Korea's elite hacking unit, following a prior $1.5bn theft from a Dubai exchange the FBI linked to North Korea.
- • Binance co-founder Yi He and CEO-level executive Richard Teng said the company will cover all hacking losses, with Teng stating "your money is safe, and we're covering every loss."
- • Initial investigation points to a compromised engineer laptop that enabled unauthorised withdrawals; Binance has suspended all deposits and withdrawals while security checks proceed.
- • Bitcoin fell more than 3% to a six-week low of $76,368, and analysts expect the breach to dampen risk appetite and prompt scrutiny of centralised exchange custody.
Summary
Binance, the world's largest cryptocurrency exchange, has been hit by an industry-record hack valued at $6.3bn (£4.7bn), according to The Guardian. Analysts have identified North Korean state-backed hackers as the likely culprits. TRM, a crypto analysis firm, attributed the attack with "high confidence" to TraderTraitor, North Korea's elite hacking unit, and Chainalysis also linked the heist to the same group. TRM and Chainalysis together claimed more than $6bn had been taken, although Binance has not explicitly confirmed the theft. The FBI has previously attributed a roughly $1.5bn theft from a Dubai-based exchange to North Korea, the prior record crypto heist.
Binance said about $3bn of the affected assets has been frozen so far and gave no update on the remaining $3.3bn. Co-founder Yi He said the company would cover "all hacking losses", and co-chief executive Richard Teng said user money was safe. Binance said an initial investigation suggested the breach began with a hacked laptop belonging to one of its engineers, which allowed an attacker to access a system and make unauthorised withdrawals. All deposits and withdrawals have been temporarily suspended while security teams secure wallet infrastructure and trace assets with law enforcement and industry partners. Binance, which has 335 million registered users and about $162.8bn in assets under custody as of its 2025 annual report, said its teams were "working around the clock." Founder Changpeng Zhao, who stepped down as CEO after pleading guilty in 2023 to a US felony related to money laundering controls and was pardoned by Donald Trump in 2025, posted on X that "User funds are safe!" while acknowledging the incident "does look like a hack on Binance."
Markets reacted immediately, with bitcoin falling more than 3% to $76,368 in early Asian trading on Friday. Tim Sun of HashKey Group said the breach may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges. Binance maintains a secure asset fund held entirely in bitcoin to protect users in security breaches, according to its website. Stablecoin issuer Tether said it froze nearly $1.57bn in linked assets and Circle froze more than $800m. World Liberty Financial, linked to the Trump family, said it worked with custodian BitGo to freeze stolen funds, and Binance said $27m in stablecoins and about $2m in World Liberty tokens had been frozen.
The incident follows a string of crypto thefts. According to TRM, attackers stole $2.9bn across almost 150 attacks last year, and Bitget reported about $350m stolen in September. The UK's Bank of England and the Financial Conduct Authority are monitoring potential exposure of UK banks, insurers and fintechs to Binance. An FCA spokesperson said Binance was not registered with the FCA to provide crypto services in the UK but that the regulator is engaging with the firm. Binance.US said it was not affected, and Coinbase said it was unaffected. Separately, Polymarket halted trading temporarily after a security incident at a third-party provider, unrelated to the Binance breach, and said it would reimburse affected traders.
Binance said about $3bn of the affected assets has been frozen so far and gave no update on the remaining $3.3bn. Co-founder Yi He said the company would cover "all hacking losses", and co-chief executive Richard Teng said user money was safe. Binance said an initial investigation suggested the breach began with a hacked laptop belonging to one of its engineers, which allowed an attacker to access a system and make unauthorised withdrawals. All deposits and withdrawals have been temporarily suspended while security teams secure wallet infrastructure and trace assets with law enforcement and industry partners. Binance, which has 335 million registered users and about $162.8bn in assets under custody as of its 2025 annual report, said its teams were "working around the clock." Founder Changpeng Zhao, who stepped down as CEO after pleading guilty in 2023 to a US felony related to money laundering controls and was pardoned by Donald Trump in 2025, posted on X that "User funds are safe!" while acknowledging the incident "does look like a hack on Binance."
Markets reacted immediately, with bitcoin falling more than 3% to $76,368 in early Asian trading on Friday. Tim Sun of HashKey Group said the breach may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges. Binance maintains a secure asset fund held entirely in bitcoin to protect users in security breaches, according to its website. Stablecoin issuer Tether said it froze nearly $1.57bn in linked assets and Circle froze more than $800m. World Liberty Financial, linked to the Trump family, said it worked with custodian BitGo to freeze stolen funds, and Binance said $27m in stablecoins and about $2m in World Liberty tokens had been frozen.
The incident follows a string of crypto thefts. According to TRM, attackers stole $2.9bn across almost 150 attacks last year, and Bitget reported about $350m stolen in September. The UK's Bank of England and the Financial Conduct Authority are monitoring potential exposure of UK banks, insurers and fintechs to Binance. An FCA spokesperson said Binance was not registered with the FCA to provide crypto services in the UK but that the regulator is engaging with the firm. Binance.US said it was not affected, and Coinbase said it was unaffected. Separately, Polymarket halted trading temporarily after a security incident at a third-party provider, unrelated to the Binance breach, and said it would reimburse affected traders.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.