Binance, the world's largest cryptocurrency exchange, says it has frozen around half of $6.3bn in stolen digital assets following what the company describes as a "complex" hack. The firm secured $3bn of the stolen funds, though many remain in unidentified hands.
Binance initially believed a DevOps engineer's compromised laptop triggered the breach, allowing unauthorized withdrawals. The company later said the attack involved multiple points of entry. Co-CEO Richard Teng stated that hackers deployed "a self-destruct mechanism that destroyed tooling and traces as they went", complicating investigation efforts.
Several cryptocurrency analytics firms, including Chainalysis and TRM Labs, have linked the hack to a North Korean hacking unit. Chainalysis said it had "high confidence" that North Korea was involved. The hack exceeds the $1.5bn heist on Bybit exchange in 2025.
The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover stolen funds and identify those responsible. Binance said it is cooperating with the FBI. The company told users "your money is safe, and we're covering every loss".
Binance initially suspended all deposits and withdrawals, then said deposits remain unaffected. The exchange, founded in China in 2017, reports more than 300 million registered users worldwide and held over $160bn in assets under custody as of 2024.