Binance hit by cyberattack, $6.3bn in crypto assets stolen

Binance, the world's largest cryptocurrency exchange, announced on Thursday that a cyberattack had affected digital assets worth $6.3bn, or roughly £4.7bn. It could turn out to be the largest theft in the industry's history.

According to the company, about half of the assets have already been frozen, but a significant portion remains in the hands of the attackers. Binance said it would fully cover the losses suffered by users. Early checks suggest the attack may have involved an engineer's compromised laptop, which allowed the attackers to make unauthorised withdrawals.

Suspicion falls on a North Korean group

Two blockchain analytics firms, TRM Labs and Chainalysis, have attributed the attack to a North Korea-linked hacking group known as TraderTraitor. The industry's previous record, a $1.5bn theft from the Bybit exchange, dates back to 2025 and was attributed to the same group. TRM Labs' global head of policy, Ari Redbord, called the incident a "watershed moment" unlike anything the industry has seen, adding that the attackers still hold an enormous sum of stolen funds and that efforts to trace and recover them are far from over.

For years, groups linked to Pyongyang have focused their cyberattacks on cryptocurrency companies in order to steal large amounts of digital tokens. Western security agencies have said the stolen funds are used to finance North Korea's nuclear weapons and missile programmes; the country has always denied any involvement in such incidents. Eric Jardine, Chainalysis' head of research, urged all exchanges to remain vigilant, since the sheer value of the assets they hold makes them particularly attractive targets.

Binance did not directly address questions about possible links to North Korea, but said it was working with law enforcement to identify those responsible. The incident concerns the Binance.com platform, while Binance.US, which serves American residents, was not affected. Co-chief executive Yi He thanked several cryptocurrency issuers for freezing the assets involved and announced that withdrawals would remain disabled until the security of the environment was confirmed.

Tether and Circle together froze about $2.4bn linked to the suspected attack: Circle blocked more than $800m in USDC, while Tether froze around $1.6bn in USDT. World Liberty Financial, a crypto company linked to US President Donald Trump, also said it had worked with its partners to freeze the stolen funds. Coinbase said it was not affected.

Founded in China in 2017, Binance has more than 300 million registered users worldwide and reported more than $160bn in assets under custody in 2024. Following news of the attack, bitcoin fell by more than 4%, while other cryptocurrencies such as ether and solana also dropped sharply.