Binance says $6.3bn in crypto assets affected by suspected record hack

Cryptocurrency exchange Binance said on Thursday that $6.3bn (£4.7bn) of digital assets had been impacted by what it described as the “largest hack in history”. The world’s biggest crypto exchange said about half of those assets had been frozen with help from other platforms, and that it would “cover all losses”.

Early checks suggested the incident may have involved an engineer’s laptop that had been compromised, allowing an attacker to make unauthorised withdrawals, Binance said. The exchange did not directly respond to BBC queries about the incident’s potential links to North Korea, but said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”

Two cryptocurrency analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor. The attack eclipses a record-setting $1.5bn hack on the Bybit exchange in 2025. TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korea-linked incidents, including the Bybit hack.

Ari Redbord, TRM Labs’ global head of policy, told the BBC that the Binance hack was a “watershed moment” unlike anything the industry had seen. The attacker still holds an enormous sum of stolen assets, he added, meaning efforts to trace and recover the funds are far from over.

Chainalysis, another crypto analytics firm, also said it had “high confidence” that the North Korean group was linked to the hack. Eric Jardine, Chainalysis’ head of research, urged every exchange to remain vigilant, saying platforms are attractive targets for hackers because of the sheer value of the assets they hold.

The incident concerns Binance.com. Binance.US, a much smaller crypto platform that provides trading services specifically for American residents, said its platform was not affected. The case has drawn attention to security practices at major exchanges, which hold large pools of customer assets and are often targeted by sophisticated hacking groups. Binance’s commitment to cover all losses is likely to be closely watched by users and regulators alike.

The company’s statement that about half the affected assets have been frozen suggests that cross-platform cooperation can play a role in limiting damage after such attacks. However, the fact that the attacker still holds a large sum underlines the difficulty of recovering stolen digital assets once they have been moved. Investigations by analytics firms and law enforcement agencies are continuing.

The $6.3bn figure, if confirmed, would far exceed the $1.5bn Bybit hack. Analysts have said such incidents highlight the risks facing an industry that holds large amounts of digital value and relies on multiple platforms to move and store assets. Binance has said it will cover all losses, while the identity of the attackers and the full scale of the incident remain subject to investigation.