Hackers stole US$6.3-billion from Binance, the world’s largest cryptocurrency exchange, in what analysts say is the biggest crypto hack ever, an attack that could prompt investors to rethink the risks of owning digital assets.
The hackers behind the raid were from North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis. The attackers targeted Binance wallets on 10 blockchains and shifted most of the funds in about 20 minutes, TRM Labs said in a statement.
Binance said it had worked with partners to freeze the affected assets, with about $3-billion located so far. It did not mention the status of the remaining $3.3-billion. Co-founder Yi He said the exchange would cover “all hacking losses”.
Binance said deposits were unaffected and it expected to resume withdrawals within 48 hours.
TRM said several features of the attack matched earlier heists linked to North Korea, including the 2025 hack of crypto exchange Bybit that the US Federal Bureau of Investigation attributed to Pyongyang. “We make this judgment with high confidence,” it said.
North Korea’s mission in Geneva and its embassy in China did not immediately respond to requests for comment.
“It’s the biggest hack in history,” said Aravind Srinivasan, head of the systematic over-the-counter business at GSR, a large crypto market maker.
Markets slide
Markets reacted immediately in Asian trading on Friday. Bitcoin dropped more than 3% to a six-week low of $76 368, and ether fell more than 3% to a two-month low of $2 178. BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5% over 24 hours at $709.70, according to market aggregator CoinGecko.
Analysts said the breach was likely to have wider ramifications for crypto, which was already under pressure from higher US interest rates and softer demand from exchange-traded fund buyers.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks,” said Tim Sun, senior researcher at Hong Kong-based HashKey Group.
An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance’s engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, the exchange said.
“The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer, which may be the entry point of the incident,” Binance said.
Binance, which lets users buy, sell and trade digital assets, has 335 million registered users and had about $162.8-billion in assets under custody, according to its 2025 annual report. “User funds remain safe,” it said.
The exchange runs a secure asset fund for users, a reserve held entirely in bitcoin that is intended to protect user assets in the event of a security breach, according to its website.
“It’s becoming very hard to counter hacks, as AI can find vulnerabilities faster than you can fix them,” said Bernardo Brites, CEO of Trace Finance, a payments and stablecoin infrastructure company. “My view is that users will move away from smaller and medium-sized exchanges. It is becoming too risky to park your money somewhere that couldn’t cover a hack of meaningful size.”
Stablecoin issuer Tether said it had frozen nearly $1.57-billion in assets linked to the incident, while Circle froze more than $800-million.
World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said on Thursday it had worked with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack. Yi said $27-million in stablecoins and about $2-million worth of World Liberty tokens had been frozen.
A string of thefts
Crypto company Ripple also froze roughly $200-million, Yi said. Jack McDonald, senior vice-president of stablecoins at Ripple, said the company was closely monitoring reports of a potential exploit involving Binance and was freezing affected funds and co-ordinating with relevant parties.
Binance.US, a separate exchange, said it was not affected. Coinbase said it was unaffected and was monitoring the situation.
Miguel Morel, CEO of blockchain intelligence company Arkham, said data indicated that billions of dollars appeared to have been hacked from Binance by an unknown actor.
The incident adds to a string of crypto thefts. Last year, attackers stole $2.9-billion worth of cryptocurrency in nearly 150 attacks, according to researchers at TRM Labs. In September, exchange Bitget said roughly $350-million in crypto had been stolen from its platform.
Authorities have warned that organised crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system.
In an unrelated incident earlier on Thursday, prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider. It later resumed trading and said it would fully reimburse affected traders. — Tom Westbrook, Ankur Banerjee, Rae Wee, Summer Zhen, Vallari Srivastava, Anusha Shah and Mrinmay Dey, (c) 2026 Reuters
