In what analysts describe as the largest heist in history, the global cryptocurrency exchange Binance has fallen victim to a record $6.3bn (£4.7bn) cyberattack. Industry experts and security researchers have identified North Korean state-backed hackers as the likely perpetrators behind the breach, which occurred late on Thursday. Q&A: How big a deal is the $6.3bn crypto heist.
Binance confirmed it had frozen approximately $3bn of the compromised assets while temporarily suspending all deposits and withdrawals to secure its wallet infrastructure. Co-chief executive Richard Teng reassured users, stating, “Bottom line – your money is safe, and we’re covering every loss.” The platform has set aside $6.34bn to fully reimburse affected customers, while its separate US entity, Binance.US, stated it was completely unaffected.
Security analysis firms including TRM, Elliptic, and Chainalysis attributed the breach with high confidence to TraderTraitor, an elite North Korean hacking collective.
Tom Robinson, chief scientist at Elliptic, noted: “This is almost certainly the largest theft of any kind in history. The raid far exceeds previous high-profile thefts, including a $1.5bn crypto robbery last year and the $1bn stolen from Iraq’s central bank by Saddam Hussein in 2003. According to Elliptic, North Korea has stolen over $6.5bn in crypto in recent years, including more than $1bn in 2026 alone, using digital assets to circumvent international sanctions. North Korea, a state hampered by sanctions and starved for cash, has become a prolific hacker of crypto, an asset it favours because it can be stolen in bulk and laundered.
Initial inquiries suggest the intrusion began with a compromised laptop belonging to a Binance engineer, allowing unauthorized access and illicit withdrawals. Binance later acknowledged that the attack involved “additional points of breach.” Holding $162.8bn in custody across 335 million registered users according to its 2025 annual report, the exchange was targeted using unprecedented, “never-seen-before” laundering patterns. Which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said, an initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance’s engineers. Authorities have warned that organised crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system. Reuters and the Associated Press contributed to this report.
The exchange’s founder, Changpeng Zhao—who was pardoned by Donald Trump in 2025 after serving a four-month prison sentence in 2024 for money laundering violations—addressed the incident on X. He stated that while he no longer manages operations, “as a shareholder, I expect all user funds will be fully covered.” Binance emphasized in a separate statement that it is collaborating with international law enforcement agencies, including the FBI and the US Secret Service, to trace and recover the remaining funds. Now a Canadian and United Arab Emirates citizen, who was jailed for four months in 2024 after pleading guilty to money laundering violations, the company was founded by the Chinese-born entrepreneur Changpeng Zhao. Zhao posted to X on Thursday: “User funds are safe!” but added that the incident “does look like a hack”. In a post on X, Binance reiterated that it was working “to trace, freeze and recover additional funds”, and signed off: “We will weather this storm.
Crypto markets reacted swiftly during early Asian trading on Friday. Bitcoin dropped 5% within hours to $77,380, reaching its lowest point in six weeks. Tim Sun, a senior researcher at HashKey Group in Hong Kong, warned that the breach “may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” particularly as the market faces pressure from rising US interest rates and weakening ETF demand.
Major industry allies and stablecoin issuers scrambled to mitigate the damage. Tether froze nearly $1.57bn in assets linked to the attack, while Circle froze over $800m. Elliptic reported that the largest losses occurred in Ethereum, with $3.8bn affected. World Liberty Financial, a crypto venture connected to Donald Trump and his family, confirmed it worked alongside custodian BitGo to freeze stolen funds. Meanwhile, rival exchange Coinbase reported no impact from the breach.
UK financial regulators are closely tracking the situation for potential spillover effects. Although Binance is not registered with the Financial Conduct Authority (FCA) to offer services in the UK, an FCA spokesperson stated: “While Binance wasn’t registered with the FCA to provide crypto services in the UK, we’re aware of the reported incident and engaging with them to understand the impact.” The Bank of England is also monitoring exposed financial institutions, though it holds no immediate systemic concerns. However, it is understood there are no active concerns.
The incident reflects a broader surge in cybercrime targeting digital assets, following a year in which hackers stole $2.9bn across nearly 150 attacks in 2025 and Bitget lost $350m in September. Separately on Thursday, prediction market operator Polymarket briefly halted operations following a third-party security incident, later resuming trading and promising full trader reimbursements.
