Hackers stole $6.3 billion from Binance in a 20-minute attack starting Thursday at 2000 GMT. US firms linked the theft to North Korean hackers. Co-CEO Richard Teng said, "We NEVER use any customer funds, so they are not impacted." Binance plans to cover all losses using its own company resources.
Hackers stole an estimated $6.3 billion worth of cryptocurrency from wallets controlled by Binance, the world's largest crypto exchange, in a sophisticated attack that unfolded in just 20 minutes. US blockchain intelligence firms have attributed the breach to North Korean hackers, calling it potentially the biggest financial theft on record.
The attack, which began shortly after 2000 GMT on Thursday, involved the manipulation of Binance's transaction approval systems, allowing hackers to transfer funds from exchange-controlled wallets into addresses under their control, Reuters reported.
According to blockchain analytics firm TRM Labs, the attackers compromised Binance's signing infrastructure, which authorises transactions. This enabled them to bypass regular approval safeguards and issue instructions to drain the affected wallets.
Binance initially suspected a compromised laptop but later identified additional points of breach. Co-CEO Richard Teng described the incident as a complex attack involving malicious software designed to erase traces of the hackers' activities.
Binance said customer funds remained safe and that it would cover the losses using company resources. The exchange has internally set aside around $6.34 billion for this purpose.
The company also operates a $1 billion bitcoin reserve fund, known as the Secure Asset Fund for Users (SAFU), to protect customers in the event of security breaches.
"We NEVER use any customer funds, so they are not impacted," Teng said in a post on X.
The exchange temporarily halted withdrawals following the breach and said it expected services to resume within 48 hours.
Blockchain analytics firms TRM Labs and Chainalysis said the attack bore similarities to previous operations attributed to North Korean hacking groups, including the $1.5 billion Bybit theft in 2025, which the FBI linked to North Korean hackers.
TRM said it was highly confident the same group was behind the Binance breach. Chainalysis also expressed strong confidence in the attribution. North Korea has routinely denied involvement in cyberattacks.
Binance is cooperating with the FBI and the US Secret Service, while the FBI confirmed it was working with public and private partners to assess the incident.
Around half of the stolen assets have been frozen by stablecoin issuers, including Tether, Circle, Ripple and World Liberty Financial.
Tether froze nearly $1.57 billion worth of assets linked to the incident, while Circle froze more than $800 million. However, freezing these assets does not automatically mean they will be returned to Binance.
The remaining bitcoin and ether are harder to restrict because they do not have centralised issuers capable of freezing transactions.
The breach has also unsettled cryptocurrency markets. Bitcoin slipped to a six-week low of $76,368, while ether fell more than 3% to a two-month low of $2,178. Binance's BNB token declined 6.2% over 24 hours.
The incident comes amid growing concerns over crypto security. TRM Labs estimates that hackers stole $2.9 billion across nearly 150 cryptocurrency attacks last year, highlighting the risks facing investors and centralised exchanges.