Hackers Steal $6.3 Billion From Binance in Record Cryptocurrency Heist

Hackers stole approximately $6.36 billion in cryptocurrency from Binance, the world's largest cryptocurrency exchange, in what blockchain analysts described as a record digital-asset theft.

Binance is investigating a record $6.36-billion cryptocurrency theft attributed by blockchain analysis firms to North Korea-linked hackers.

Investigators attributed the attack with high confidence to North Korea-linked hackers.

The attack sent cryptocurrency prices lower and forced Binance to temporarily suspend withdrawals while it investigated the breach.

The exchange said customer funds were safe and pledged to cover the losses using its Secure Asset Fund for Users (SAFU) and company resources.

Blockchain analysis firms TRM Labs and Chainalysis said approximately $6.36 billion in assets had been moved from Binance wallets across 10 blockchains, with most of the theft occurring within about 20 minutes.

About half of the stolen assets were reportedly frozen through cooperation with stablecoin issuers and other industry partners, including Tether, Circle and World Liberty Financial.

Binance said it had located or helped freeze approximately $3 billion in assets.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance said.

The exchange initially suspected that hackers had gained access through a compromised laptop belonging to one of its engineers.

The breach may have allowed an attacker to enter a service container and submit unauthorized withdrawal transactions.

“Our security team is tracing the full attack path through the compromised computer, which may be the entry point of the incident,” Binance said. The company later reported finding additional points of compromise.

Former Mt. Gox chief executive Mark Karpelès suggested that the attackers may have gained access to private keys associated with at least two Binance wallets.

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, citing similarities with previous cyberattacks.

The method reportedly involved compromising Binance's transaction-signing infrastructure and issuing unauthorized instructions to transfer assets into wallets controlled by the attackers.

The incident bears similarities to the 2025 attack on cryptocurrency exchange Bybit, which the U.S. Federal Bureau of Investigation attributed to North Korean hackers.

Binance operates SAFU, a reserve fund established to protect users in the event of security breaches.

The fund was valued at approximately $1 billion, although Binance also said company resources would be used to cover the losses.

The scale of the theft has raised fresh concerns about the security of cryptocurrency exchanges and the ability of cybercriminal groups to exploit weaknesses in digital-asset infrastructure.