Hackers stole an estimated $6.3 billion from Binance in a massive security breach. The exchange suspended withdrawals to secure its systems after an engineer’s laptop was hacked. Binance said, "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it."
Hackers have stolen an estimated $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts have described as potentially the biggest financial heist in history, Reuters reported.
The massive breach triggered a sell-off in cryptocurrency markets, prompting Binance to temporarily suspend withdrawals as it moved to contain the damage.
The exchange said it would use its own funds to cover the losses and assured customers that their assets remained safe.
Quick answers to key questions
Binance reported a security breach involving an estimated $6.3 billion in cryptocurrency assets. The incident led the exchange to temporarily suspend withdrawals while it investigated and secured its systems.
An initial investigation suggested the breach may have begun with a hacked laptop belonging to one of Binance's engineers, which could have helped an attacker access a system and make unauthorised withdrawals. Investigators were still examining how the attackers gained access.
Binance said it had located around $3 billion of the affected funds. Stablecoin issuers and other partners froze some assets linked to the incident.
Binance suspended withdrawals as a precaution while its security teams checked the platform, secured its wallet infrastructure and traced affected assets. The exchange said services would resume once its security environment was considered safe.
Blockchain analytics firm Chainalysis said it had high confidence that a North Korea-linked hacking group was involved. The attribution has not been confirmed, and the investigation is ongoing.
The incident has also drawn attention to North Korea-linked hacking groups, with blockchain analytics firm Chainalysis expressing "high confidence" that operatives linked to Pyongyang were behind the attack, according to the BBC.
Binance said it was coordinating with law enforcement agencies, including the US Federal Bureau of Investigation (FBI) and the US Secret Service (USSS), to investigate the breach.
"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," the company said in a post on X.
What happened in Binance crypto hack?
The attack resulted in the theft of approximately $6.3 billion in cryptocurrency assets, making it one of the largest reported breaches involving a digital asset platform.
Binance said it had identified and located around $3 billion of the stolen funds so far, with stablecoin issuers stepping in to freeze a substantial portion of the affected assets.
Among those involved were El Salvador-based Tether and Trump-backed World Liberty Financial, which froze assets linked to the incident.
The exchange initially suspended withdrawals, with co-CEO Yi He saying that services would remain disabled until the platform's security environment was confirmed to be safe.
Binance subsequently indicated that it expected withdrawal services to resume within 48 hours.
The company also said it had internally allocated approximately $6.34 billion to cover the losses, although it did not disclose the precise sources of these funds.
Binance maintains a $1 billion Bitcoin reserve fund, designed to provide protection to customers in the event of security breaches. Founder Changpeng Zhao also said on X that the company held SpaceX shares worth more than $1 billion.
Chainalysis said it had "high confidence" that a North Korea-linked hacking group was involved in the breach, the BBC reported.
North Korean-linked cyber operatives have increasingly targeted cryptocurrency exchanges and digital asset companies in recent years, stealing large amounts of virtual currencies.
Western intelligence and security agencies have previously warned that proceeds from such cyberattacks are used to finance Pyongyang's weapons programmes, including its nuclear and ballistic missile development, as per the BBC report.
However, investigators are still examining how the attackers gained access and moved the stolen funds.
In a separate update, Binance said its investigation had identified additional points of compromise.
"We are still gathering the facts, and will share more directly as we have them," the company said.
According to Dave from cybersecurity firm Check Point, the Binance incident bore similarities to an attack on cryptocurrency exchange Bitget in September, in which approximately $388 million was stolen, BBC reported.
The emerging concern is that hackers may no longer need direct access to cryptocurrency vault keys to execute large-scale thefts.
Instead, they could be targeting the systems, infrastructure and individuals authorised to access and transfer digital assets.
The exchange also thanked stablecoin issuers for their assistance in blocking transactions involving the affected assets.
Co-CEO Yi He said customer withdrawals would remain suspended until the platform's security environment was considered safe.
The company has maintained that customer funds are secure and that it has sufficient resources to absorb the financial impact of the breach.
The company said in 2024 that it held more than $160 billion in assets under custody.
The scale of the reported theft raises fresh questions about the security of centralised cryptocurrency exchanges, which hold vast amounts of digital assets and remain attractive targets for sophisticated hacking groups.