SRINAGAR: Hackers have stolen an estimated $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what industry analysts have described as the largest cyber heist in digital asset history, with blockchain intelligence firms tracing the attack to North Korea.
According to TRM Labs, the attackers targeted Binance wallets across 10 different blockchains and transferred most of the funds within an estimated 20-minute period. Blockchain intelligence firms TRM Labs and Chainalysis linked the operation to North Korean threat actors.
Reuters reported that TRM Labs had expressed high confidence in the attribution, citing similarities between the Binance breach and previous cyber operations associated with North Korea. These included the 2025 attack on cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation (FBI) formally attributed to Pyongyang.
Preliminary internal investigations by Binance suggest that the breach may have originated from a compromised endpoint, with an engineer’s laptop suspected to have provided the initial access to the exchange’s internal systems.
Binance said its security team was examining the complete sequence of events to establish how the attackers gained access and executed unauthorised withdrawals.
“The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” the exchange said.
Aravind Srinivasan, head of the systematic over-the-counter (OTC) business at cryptocurrency market maker GSR, described the scale of the incident as “the biggest hack in history”.
Binance co-CEO Richard Teng sought to reassure customers following the breach, saying the exchange would cover all losses and that users’ funds remained safe.
In a statement posted on X, Teng said the initial investigation indicated that a compromised laptop belonging to a DevOps engineer may have enabled the attacker to access a service container and submit unauthorised withdrawal transactions.
He clarified that the intrusion involved a more complex process than the misuse of an individual employee’s permissions and said the investigation had not established responsibility on the part of any particular person.
Teng said Binance had found no evidence that wallet private keys had been compromised.
The exchange estimated the total financial impact at approximately $6.3 billion, of which around $3 billion had been frozen on-chain through coordination with blockchain partners.
Binance said it would meet all losses using resources from its Secure Asset Fund for Users (SAFU) and company funds. It also confirmed that deposits remained unaffected and were operating normally.
As part of its response, the exchange temporarily suspended withdrawals while strengthening the security of its withdrawal services and associated addresses. It also revoked authorisations linked to the affected addresses and engaged law enforcement agencies and blockchain intelligence partners to trace and recover the stolen assets.
Teng said Binance would release a detailed technical post-mortem after the investigation was completed and the facts verified. The exchange also plans to publish an updated proof of reserves once the security remediation work is finished.
The incident has renewed concerns over the cybersecurity of centralised cryptocurrency exchanges and the risks associated with holding large amounts of digital assets on trading platforms.
