Binance, the world's largest cryptocurrency exchange, reported on Thursday that digital assets worth $6.3 billion (£4.7 billion) were impacted in what could mark the largest cyberattack in history.
While roughly half of those assets have been frozen, a significant portion remains under the control of the hackers. Binance has pledged to fully cover all user losses resulting from the breach.
Initial investigation findings suggest the security breach originated from a compromised laptop belonging to an engineer, enabling the attacker to execute unauthorized withdrawals. The security failure specifically targeted Binance.com. In contrast, Binance.US, a distinct and much smaller platform serving American residents, confirmed that its system remained completely unaffected.
Two digital analytics firms have tied the breach to TraderTraitor, a cyberattack unit linked to North Korea. TRM Labs, an AI-focused blockchain investigation company, noted that elements of the Binance intrusion mirror previous North Korean operations, including a record-setting $1.5 billion hack on the Bybit exchange in 2025.
Ari Redbord, global head of policy at TRM Labs, described the attack as a "watershed moment" unlike anything the sector has seen, adding that efforts to trace and recover the funds are far from complete because the hacker still holds an enormous sum of stolen assets.
Chainalysis similarly expressed "high confidence" in connecting the North Korean group to the incident. Eric Jardine, Head of Research at Chainalysis, urged all trading platforms to maintain heightened vigilance due to the sheer value of assets they safeguard.
Western intelligence agencies have previously stated that stolen digital tokens are used by Pyongyang to finance its nuclear weapons and missile development programs, though North Korea has consistently denied involvement in cyber thefts.
Asked about potential links to North Korea, Binance did not address the claims directly but stated it is working closely with law enforcement partners to identify the perpetrators and bring them to justice.
Following suspicious activity flagged by market observers hours before Binance officially confirmed the breach, several major industry entities took action to freeze illicit assets. Binance co-chief executive Yi He announced that withdrawals have been temporarily disabled until the system is confirmed to be secure, expressing gratitude to cryptocurrency issuers for assisting in freezing funds.
Stablecoin issuers Tether and Circle together froze approximately $2.4 billion in linked assets. Circle chief executive Jeremy Allaire confirmed his firm froze over $800 million in USDC assets tied to the incident, while Paolo Ardoino, chief executive of USDT issuer Tether, stated that protecting the industry and partners is the firm's top priority.
Additionally, World Liberty Financial—a crypto firm linked to US President Donald Trump and his family—worked with partners to freeze stolen tokens, while rival exchange Coinbase reported no impact and said it is monitoring the situation.
Founded in China in 2017, Binance serves more than 300 million registered users globally and reported having over $160 billion in assets under custody in 2024 despite facing extensive regulatory scrutiny worldwide. News of the breach prompted immediate market declines, sending Bitcoin down by more than 4% while other major cryptocurrencies, including Ethereum and Solana, dropped sharply.
Early checks show the incident may have involved an engineer's laptop that had been compromised, which allowed an attacker to make unauthorised withdrawals, Binance said.
"Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said.
Related Articles
Mr. Udoy is a professional Web Developer and Blogger with 7+ years of experience in the tech world. He specializes in web architecture and digital storytelling. As the driving force behind worldincidents.com, he focuses on delivering high-quality, well-researched content to a global audience.