Binance, the world's largest cryptocurrency exchange, disclosed Thursday that $6.3bn in digital assets were compromised in what analytics firms describe as the largest cryptocurrency hack on record. About half those assets have been frozen with help from other platforms. Binance said it will cover all losses.
Early investigation suggests a compromised engineer's laptop enabled the unauthorized withdrawals, according to the exchange. Two crypto analytics firms, TRM Labs and Chainalysis, attributed the attack to TraderTraitor, a North Korean hacking unit. TRM Labs said the incident eclipses a $1.5bn Bybit hack in 2025. Chainalysis expressed "high confidence" in the North Korean link. Binance did not directly confirm the North Korea connection but said it is working with law enforcement "to confirm the identity of these criminals and bring them to justice."
The attacker retains a substantial portion of the stolen assets, meaning recovery efforts remain incomplete, TRM Labs' Ari Redbord told the BBC. Chainalysis Head of Research Eric Jardine warned that all exchanges remain attractive targets due to their asset holdings.
Other major platforms responded by freezing related assets. Tether froze approximately $1.6bn, while Circle froze over $800m. World Liberty Financial, linked to US President Donald Trump and his family, said it worked with partners to freeze stolen funds. Coinbase reported it was unaffected and monitoring the situation.
Binance.US, the exchange's platform for American residents, said it was not impacted. Binance paused withdrawals pending security confirmation.
Bitcoin fell more than 4% following initial alerts. Ethereum and Solana also declined sharply.