Cryptocurrency giant Binance stated on Thursday that $6.3 billion (£4.7 billion) in digital assets were affected, suggesting it may have encountered the largest cryptocurrency hacking attack on record.
The world's largest cryptocurrency exchange stated that approximately half of its assets have been frozen, but many assets are still in the hands of hackers, and added that it will "bear all losses."
Anchorage stated that preliminary checks indicate that this incident may involve the intrusion into an engineer's laptop, and the attackers used this to carry out unauthorized withdrawals.
Two analysis firms attributed this incident to a North Korean hacking group named TraderTraitor. The scale of this incident surpassed the record-breaking hacker attack of $1.5 billion that occurred on the Bybit exchange in 2025.
Cybersecurity company Check Point indicates that this organization is also known in the industry as Lazarus Group, which has been implicated in a hacking attack that occurred in 2025.
Check Point Chief Information Security Officer Jayant Dave stated that the losses estimated by Binance make it "the largest cryptocurrency theft case on record."
An artificial intelligence-driven investigative firm, TRM Labs, stated in its report that several characteristics of the Binance attack are similar to previous incidents related to North Korea, including the Bybit hacking incident.
The global policy director of the laboratory, Ari Redbord, told BBC that this Binance hack incident is a "watershed moment," different from any situation seen before in the industry.
Redbord added that the attackers still hold a large amount of stolen assets, which means that the work of tracking down and recovering the funds is far from over.
Binance was established in 2017, with its headquarters initially located in China. It allows users to trade digital assets and is estimated to have over 300 million registered users worldwide.
In 2024, the company stated that its managed assets exceeded $160 billion.
This exchange has been under global regulatory scrutiny throughout.
Cryptocurrency analysis firm Chainalysis also stated that they are “highly confident” that this hacking incident is related to a North Korean organization.
In the past few years, actors associated with North Korea have been focusing on attacking cryptocurrency companies in order to steal a large amount of digital tokens.
Western security agencies have previously stated that the stolen funds were used to fund North Korea's nuclear weapons and missile development programs.
The North Korean regime has previously denied involvement in cyberattacks.
Chainalysis Research Supervisor Eric Jardine Urges all exchanges to remain vigilant, as the assets held by the platform are of great value and thus highly attractive to hackers.
Binance did not directly respond to the question from BBC regarding whether this incident is related to North Korea, but stated: "We are working closely with law enforcement partners to identify these criminals and bring them to justice."
This incident involves Binance.com; whereas Binance.US, which is much smaller in scale and specifically provides trading services for US residents, indicates that its platform has not been affected.
Anbin's Co-CEO, Richard Teng, stated that preliminary company investigations indicate that the hacker attack originated from an intruded engineer's laptop.
"This allows attackers to access a service container and submit unauthorized withdrawal transactions within it," he said in his statement.
It needs to be clear that the attacker did not simply use the privileges of one engineer; this was not a single 'one-click' operation. It involved a more complex attack process. Our investigation has not yet attributed responsibility to any individual. At present, we have not found any evidence of wallet private keys being leaked.
The Dave of Check Point indicates that this attack is similar to the hacking incident that occurred in September at the cryptocurrency trading platform Bitget, which resulted in a loss of 388 million US dollars (289 million pounds): "This means that attackers no longer need the vault keys. They are targeting systems and individuals that have access to use these keys."
In a series of posts, Binance's Co-CEO Yi He thanked several cryptocurrency issuers for freezing the relevant assets.
"Safety first: Withdrawals have been temporarily suspended until the environment is confirmed to be safe," she said.
Another two major cryptocurrency platforms, Tether and Circle, stated that they have frozen a total of approximately $2.4 billion in assets in response to this potential Binance hacking incident.
An encryption company associated with U.S. President Donald Trump and his family, World Liberty Financial, stated that it has collaborated with partners to freeze the stolen funds.
Cryptocurrency exchange Coinbase stated that its platform has not been affected by this incident and is monitoring the situation.
Hours before Binance confirmed the security issue, several observers in the cryptocurrency industry had already issued warnings that Binance might be subject to a hacker attack.
After these alerts appeared, Bitcoin fell by more than 4%. The prices of other major cryptocurrencies such as Ethereum and Solana also tumbled significantly.
