Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets. About half the stolen assets were quickly frozen by stablecoin issuers such as Tether, Circle and the Trump-backed World Liberty Financial.
"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," Binance said in a post on X. The exchange said customer funds were safe and that it was working with partners to freeze some of the affected assets, with about $3 billion located so far.
It expects to resume withdrawal services in the next 45 hours. It did not mention the status of the remaining $3.3 billion.
Binance runs a secure asset fund for users, a $1 billion bitcoin reserve designed to protect customer assets in the event of security breaches, according to its website. Co-CEO Teng said that "company funds" would cover losses.
The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis. TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation (FBI) attributed to North Korea.
"TRM attributes the attack to North Korea's elite hacking unit," the firm said. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
North Korea has for years used state-linked cyber units for espionage and financial theft, according to US and South Korean authorities. North Korea routinely denies this.
"Your money is safe and we're covering every loss," Teng said on X. "It's the biggest hack in history," Aravind Srinivasan at market maker GSR said as crypto prices fell broadly.
Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178. BNB was down 5% at $709.70, according to CoinGecko.
An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers. Later, the company added it had uncovered additional points of breach.
Mark Karpeles, former chief of defunct Tokyo-based bitcoin exchange Mt Gox, said attackers probably accessed private keys for at least two Binance wallets. The scale of this incident has sent shockwaves through the global financial technology sector.
Regulators are now expected to tighten oversight on centralized exchanges to prevent such massive outflows in the future. As the investigation continues, the focus remains on tracking the remaining $3.3 billion currently held in illicit wallets.
Industry experts warn that this event highlights the vulnerability of even the most secure platforms. Binance has pledged to overhaul its security protocols once the situation is stabilized.
The crypto community remains on high alert as the market attempts to recover from the sudden volatility caused by the breach. For now, Binance users are advised to remain cautious and monitor official channels for updates regarding the restoration of services.
The company's commitment to covering losses is seen as a critical step in maintaining market stability during this unprecedented crisis.