A hacked laptop may have opened the door to Binance’s $6.3 billion breach
Binance says an initial investigation points to a compromised computer belonging to one of its engineers. Blockchain analysts have linked the attack to North Korea, while billions in assets have been frozen by crypto companies.
Hackers stole an estimated $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what analysts say could be the biggest crypto heist on record. The breach is likely to raise fresh questions about the risks of holding digital assets, particularly on centralized exchanges.
The hackers were linked to North Korea by U.S. blockchain analysis firms TRM Labs and Chainalysis. The attackers targeted Binance wallets across 10 blockchains and moved most of the funds within about 20 minutes, TRM Labs said in a statement.
Binance said it had worked with partners to freeze affected assets, with approximately $3 billion located so far. The exchange did not provide an update on the remaining $3.3 billion. Its co-founder, Yi He, said Binance would cover “all hacking losses.”
The exchange said customer deposits were unaffected and that it expected to resume withdrawal services within 48 hours.
TRM Labs said several features of the attack resembled previous heists linked to North Korea, including the 2025 hack of cryptocurrency exchange Bybit, which the U.S. Federal Bureau of Investigation attributed to Pyongyang.
“We make this judgment with high confidence,” the firm said.
North Korea’s mission in Geneva and its embassy in China did not immediately respond to Reuters’ requests for comment.
The incident could rank as the largest cryptocurrency heist on record, according to Chainalysis and other industry experts.
“It’s the biggest hack in history,” said Aravind Srinivasan, head of the systematic over-the-counter business at major crypto market maker GSR.
Markets reacted sharply in Asian trading on Friday. Bitcoin fell more than 3% to a six-week low of $76,368, while ether dropped by more than 3% to a two-month low of $2,178. BNB, a token originally launched as Binance Coin that can be used to pay trading fees on the exchange, fell 5% over 24 hours to $709.70, according to CoinGecko.
Shares in cryptocurrency exchange Coinbase Global slid 4.8%, while those of bitcoin-buying company Strategy fell nearly 6% in extended U.S. trading.
An initial investigation suggested the breach may have originated with a compromised laptop belonging to one of Binance’s engineers. The attacker allegedly used the device to gain access to one of the exchange’s systems and make unauthorized withdrawals, Binance said.
“The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer, which may be the entry point of the incident,” the company said.
Beyond the potential loss of funds, the breach could have wider implications for the cryptocurrency industry, which was already facing pressure from higher U.S. interest rates and weaker demand from exchange-traded fund investors, analysts said.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and held approximately $162.8 billion in assets under custody, according to its 2025 annual report.
“User funds remain safe,” Binance said.
Binance operates a Secure Asset Fund for Users, a reserve held entirely in bitcoin and intended to protect customer assets in the event of security breaches, according to the exchange’s website.
But some industry executives warned that increasingly sophisticated attacks could make it harder for exchanges to protect themselves.
“It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them,” said Bernardo Brites, CEO of payments and stablecoin infrastructure company Trace Finance.
“My view is that users will move away from smaller and medium-sized exchanges. It’s becoming too risky to park your money somewhere that couldn’t cover a hack of meaningful size.”
Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.
World Liberty Financial, a cryptocurrency company linked to U.S. President Donald Trump and his family, said on Thursday that it had worked with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack. Yi said $27 million in stablecoins and approximately $2 million worth of World Liberty tokens had been frozen.
Ripple also froze roughly $200 million in funds, according to Yi. Jack McDonald, Ripple’s senior vice president of stablecoins, said the company was monitoring reports of a potential exploit involving Binance, freezing affected funds and coordinating with relevant parties.
Miguel Morel, CEO of blockchain intelligence firm Arkham, said data indicated that billions of dollars appeared to have been stolen from Binance by an unknown actor.
The incident adds to a series of major cryptocurrency thefts. Last year, attackers stole approximately $2.9 billion in cryptocurrency across nearly 150 attacks, according to TRM Labs. In September, cryptocurrency exchange Bitget said roughly $350 million in digital assets had been stolen from its platform, underscoring the industry's continued vulnerability to cyberattacks.
Authorities have warned that organized crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system.
Binance.US, a separate cryptocurrency exchange, said it was not affected by the incident. Coinbase also said it was unaffected and was monitoring the situation.
