Cryptocurrency exchange Binance confirmed Friday that hackers stole about $6.3bn in digital assets, and security investigators linked the attack to North Korea.
The company pledged to cover all customer losses and reported freezing around $3bn in affected assets. Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with high confidence.
Elliptic and Chainalysis also linked the theft to North Korean operatives. The attack began late Thursday, with hackers transferring assets from the world’s largest cryptocurrency exchange.
Binance initially suspected that attackers had compromised an engineer’s laptop to gain access to its systems. However, investigators subsequently discovered additional points of entry.
The exchange temporarily suspended withdrawals while its security teams examined the breach and secured affected systems.
Binance co-chief executive Richard Teng assured customers that the company would cover their losses. The exchange set aside $6.34bn in company funds to meet its commitments.
Stablecoin issuer Tether reported freezing nearly $1.57bn in assets linked to the theft. Circle separately froze more than $800m.
Elliptic estimated that Ethereum accounted for approximately $3.8bn of the stolen assets. Its chief scientist, Tom Robinson, described the incident as “almost certainly the largest theft of any kind in history”.
Read: Binance Hack Affects $6.3bn as Firms Freeze $3bn in Assets
The loss exceeds the $1.5bn cryptocurrency theft from Bybit in 2025, which US authorities attributed to North Korean hackers.
Bitcoin fell about 5% to $77,380 after news of the breach emerged, reaching its lowest level in six weeks. Binance is working with law enforcement agencies, including the Federal Bureau of Investigation (FBI) and US Secret Service, to trace the remaining assets.
The company has promised a detailed technical report once investigators establish how the attack occurred. Binance confirmed that hackers stole approximately $6.3bn in cryptocurrency, while blockchain investigators linked the attack to a North Korean hacking group.
