Hackers have stolen $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in the largest theft in crypto history. Analysts have pinned the attack on North Korea, and it could shake faith in digital assets.
Cryptocurrency prices fell on the news. Binance halted withdrawals and said it would cover the losses. Stablecoin issuers such as Tether and Circle, along with the Trump-backed World Liberty Financial, quickly froze about half of the stolen assets.
Attack unfolded in 20 minutes
Most of the heist took place over about 20 minutes, beginning late on Thursday. According to US blockchain analysis firms TRM Labs and Chainalysis, it resembled earlier large attacks blamed on North Korea.
TRM said the attackers were able to order wallets used by Binance to empty into hacker-controlled wallets. This mirrors a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation attributed to Pyongyang.
"TRM attributes the attack to... North Korea's elite hacking unit," the firm said in an analysis posted on its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
"It's the biggest hack in history," said Aravind Srinivasan of market maker GSR as crypto prices fell broadly.
US and South Korean authorities and cybersecurity experts say North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation. North Korea routinely denies this. Its mission in Geneva and its embassy in China did not immediately respond to requests for comment from Reuters.
Binance says user funds are safe
Binance said user funds were safe and that it was working with partners to freeze affected assets, with about $3 billion located so far. It expects to resume withdrawals within 48 hours. It did not give the status of the remaining $3.3 billion.
"Your money is safe and we're covering every loss," co-CEO Richard Teng said on X. "Our investigation has not attributed responsibility to any individual." He added that Binance would use "company funds" to cover losses.
Binance runs a secure asset fund, a $1 billion reserve held entirely in bitcoin, which is intended to protect users in the event of a security breach, according to its website. The size of the hack far exceeds that reserve.
Binance has 335 million registered users globally and held about $162.8 billion in assets under custody, according to its 2025 annual report.
Markets rattled
Bitcoin hit a six-week low of $76,368, and ether fell more than 3% to a two-month low of $2,178 before markets stabilized.
BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5% over the past 24 hours at $709.70, according to CoinGecko.
Shaky confidence also hit listed crypto firms. Shares in Coinbase Global, which said it was unaffected, slid 4.8%. Shares in bitcoin buyer Strategy fell nearly 6% in extended US trading.
Compromised laptop may be entry point
An initial investigation suggests the breach may have begun with a hacked laptop belonging to one of Binance's engineers. This allegedly gave an attacker access to one of its systems and let them make unauthorized withdrawals, the exchange said.
"Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident," Binance said.
Mark Karpeles, former chief of defunct Tokyo-based bitcoin exchange Mt Gox, which collapsed a dozen years ago after $500 million in bitcoin was stolen, said the attackers probably accessed private keys for at least two Binance wallets.
"Binance appears to have split its assets across multiple systems, ensuring a hack can only affect a part of the assets, but even so a single hack is a large loss," he said.
Funds frozen
Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.
World Liberty Financial said it worked with custodian BitGo to freeze funds. Binance co-founder Yi He said $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen. She added that crypto firm Ripple had also frozen roughly $200 million.
Wider impact on crypto
Analysts said the breach was likely to have wider ramifications for crypto, which was already under pressure from higher US interest rates and softer demand from exchange-traded fund buyers.
"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges," said Tim Sun, senior researcher at Hong Kong-based HashKey Group.
The incident adds to a string of crypto thefts. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to TRM Labs researchers. In September, cryptocurrency exchange Bitget said roughly $350 million in crypto had been stolen from its platform, underscoring the industry's vulnerability to hackers.
