The world’s largest cryptocurrency exchange, Binance, has suffered a reported $6.3 billion security breach, raising fresh concerns about cybersecurity risks in the digital asset industry. Blockchain analysis firms TRM Labs and Chainalysis have expressed high confidence that North Korean state-linked hackers were responsible for the attack, which has been described by market participants as one of the largest cryptocurrency thefts on record.
The incident triggered a decline in cryptocurrency prices, while Binance temporarily halted withdrawals and began coordinating with industry partners to recover the stolen assets. The exchange said that customer funds remained safe and that it would cover the losses using its own resources. However, the scale of the breach has raised questions about the security arrangements of centralised cryptocurrency platforms.
According to blockchain investigators, the main part of the attack took place within approximately 20 minutes late on Thursday. TRM Labs said the attackers manipulated wallet-related operations to move funds from Binance-controlled systems into wallets under their control. The method reportedly resembled the 2025 attack on cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korean hackers.
Both TRM Labs and Chainalysis said their investigations pointed strongly towards North Korea. TRM specifically linked the operation to what it described as the country’s elite hacking unit. North Korea has previously been accused by US and South Korean authorities of using state-linked cyber operations to generate revenue through financial theft and espionage. Pyongyang has routinely denied such allegations.
Binance Begins Recovery Efforts as Billions in Assets Are Frozen
Following the discovery of the breach, Binance said it was working with cryptocurrency companies, stablecoin issuers and other industry partners to identify and freeze the affected assets.
According to the information provided by the exchange and its partners, approximately $3 billion worth of the stolen assets had been located. Several major stablecoin issuers and cryptocurrency firms also took action to restrict the movement of funds connected to the incident.
Tether reportedly froze nearly $1.57 billion in assets linked to the attack, while Circle froze more than $800 million. World Liberty Financial also said it had worked with digital asset custodian BitGo to freeze associated funds. Binance co-founder Yi He additionally reported that approximately $27 million in stablecoins and around $2 million worth of World Liberty tokens had been frozen. Cryptocurrency company Ripple reportedly froze another $200 million.
Binance co-CEO Richard Teng assured users that their funds were protected and that the company would absorb the financial losses.
“Your money is safe and we’re covering every loss,” Teng said in a statement posted on X. He added that the company’s investigation had not attributed responsibility to any individual.
The exchange expected withdrawal services to resume within 48 hours of the incident. However, the status and recovery prospects of the remaining approximately $3.3 billion had not been clarified in the reported update.
Cryptocurrency Markets React to the Security Breach
The reported theft added pressure to an already uncertain cryptocurrency market. Bitcoin fell to a six-week low of $76,368, while Ethereum declined by more than 3% to approximately $2,178, reaching its lowest level in two months before prices stabilised.
Binance’s associated BNB token also came under pressure, falling approximately 5% over a 24-hour period to $709.70, according to CoinGecko data cited in the report.
The impact extended beyond cryptocurrency tokens. Shares of Coinbase Global, another major cryptocurrency exchange that said it was unaffected by the incident, declined 4.8%. Shares of Strategy, a company known for its large Bitcoin holdings, fell nearly 6% in extended US trading.
Market participants warned that the incident could weaken investor confidence in centralised exchanges, particularly at a time when the digital asset market was already facing pressure from higher US interest rates and softer demand from exchange-traded fund investors.
Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said the breach could further reduce investor appetite for risk and encourage investors to reconsider the safety of assets held on centralised platforms.
Compromised Engineer’s Laptop Under Investigation
Binance’s initial investigation suggested that the breach may have originated from a compromised laptop belonging to one of its engineers.
According to the exchange, the attacker may have used access obtained through the compromised computer to enter one of its systems and initiate unauthorised withdrawals.
The company’s security team was examining the full attack path to establish how the device was compromised and how the attackers gained access to the affected systems.
The incident also raised questions about how cryptocurrency exchanges manage private keys, internal access permissions and the separation of digital assets across different security systems.
Mark Karpeles, the former head of the now-defunct Mt. Gox cryptocurrency exchange, suggested that the attackers may have gained access to private keys associated with at least two Binance wallets.
He noted that Binance appeared to have distributed its assets across multiple systems, limiting the potential damage from an individual breach. However, the incident demonstrated that even a segmented security structure could face significant risks if critical wallet access mechanisms were compromised.
Security Concerns Extend Beyond Binance
The reported breach comes amid a series of major cryptocurrency thefts that have highlighted vulnerabilities across the digital asset ecosystem.
According to TRM Labs, approximately $2.9 billion worth of cryptocurrency was stolen across nearly 150 attacks during the previous year. In another incident, cryptocurrency exchange Bitget reported in September that approximately $350 million in digital assets had been stolen from its platform.
Binance itself operates a Secure Asset Fund for Users, commonly known as SAFU, which maintains a reserve intended to protect customers in the event of security-related losses. According to the exchange’s website, the fund holds approximately $1 billion entirely in Bitcoin.
However, the reported $6.3 billion theft significantly exceeds the stated size of that reserve, placing additional attention on Binance’s commitment to cover the losses through its own funds.
The exchange serves approximately 335 million registered users globally and held around $162.8 billion in assets under custody, according to its 2025 annual report.
The incident highlights a broader challenge for the cryptocurrency industry: as digital asset platforms expand their user base and financial operations, maintaining secure infrastructure becomes increasingly important. The ability to freeze assets and coordinate across companies has demonstrated the role of industry cooperation in responding to cyberattacks. At the same time, the scale of the reported breach raises questions about the effectiveness of existing safeguards and the long-term confidence investors can place in centralised cryptocurrency exchanges.
