Cryptocurrency giant Binance has said $6.3bn (£4.7bn) of digital assets were affected by what could be the largest hack in history.
The world’s biggest crypto exchange said about half of those assets had been frozen but many remained in the hands of the hackers, adding that it would “cover all losses.”
Early checks show the incident may have involved an engineer’s laptop that had been compromised, allowing an attacker to make unauthorised withdrawals, Binance said.
Two analytics firms have linked the incident, which is bigger than the record-setting $1.5bn hack on the Bybit exchange in 2025, to a North Korean hacking unit called TraderTraitor.
AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.
The lab’s global head of policy, Ari Redbord, told the BBC the Binance hack is a “watershed moment” unlike anything the industry has seen.
The attacker still holds an enormous sum of stolen assets, meaning efforts to trace and recover the funds are far from over, Redbord added.
Chainalysis, another crypto analytics firm, also said it has “high confidence” that the North Korean group is linked to the hack.
For the last few years, North Korea-linked operatives have focused on attacking cryptocurrency companies to steal large amounts of digital tokens.
Western security agencies have previously said stolen funds are used to finance North Korea’s nuclear weapons and missile development programmes. The regime has denied any involvement in hacks in the past.
Eric Jardine, Chainalysis’ Head of Research, urged every exchange to stay vigilant, as the platforms are attractive targets for hackers due to the huge value of assets.
Binance did not directly answer BBC questions about the incident’s possible links to North Korea, but said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”
The incident concerns Binance.com, while the much smaller crypto platform Binance.US, which provides trading services specifically for American residents, said its platform is not affected.
In a series of posts, Yi He, Binance’s co-chief executive, thanked various cryptocurrency issuers for freezing the assets.
“Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,” she said.
Two other major crypto platforms, Tether and Circle, said they had frozen a total of about $2.4bn of assets in response to the potential Binance hack.
Circle chief executive Jeremy Allaire said his firm is “closely tracking reports of a potential exploit involving Binance” and that his company had frozen more than $800m in assets linked to the incident.
Circle is the issuer and co-creator of the USDC, one of the world’s largest US dollar-backed cryptocurrencies.
Tether CEO Paolo Ardoino said his firm had frozen around $1.6bn “related to a potential Binance exchange hack.”
“Protecting the industry and our partners is our main priority,” said Ardoino, whose company issues a cryptocurrency known as USDT.
World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it had worked with its partners to freeze stolen funds.
Crypto exchange Coinbase said it was unaffected by the incident and was monitoring the situation.
Several crypto industry observers had flagged concerns about a potential hack on Binance hours before the exchange confirmed the security issue.
Binance, which was founded in China in 2017, allows users to trade digital assets and is estimated to have more than 300 million registered users worldwide.
The exchange has been subject to regulatory scrutiny around the world.
The company said in 2024 that it has more than $160bn in assets under custody.
Bitcoin dropped by more than 4% following the alerts. The price of other major cryptocurrencies, including Ethereum and Solana, also fell sharply.
