North Korea-Linked Hackers Suspected in $6.3 Billion Binance Breach

Binance, the world's largest cryptocurrency exchange by daily trading volume, said on Thursday that it was investigating a suspected security breach with an estimated impact of USD6.3 billion, in what analysts believe could become the biggest cryptocurrency heist on record.

The company said it had worked with other blockchain businesses to freeze the affected assets, recovering control of approximately USD3 billion so far. It did not explain what had happened to the remaining USD3.3 billion.

Binance later confirmed the estimated scale of the incident on its Latin American X account, putting the total impact at around USD6.3 billion (€5.5 billion). The company said about USD3 billion (€2.6 billion) had been frozen on-chain.

Former Binance CEO Changpeng Zhao, who remains a major shareholder, described the incident as a likely hack. "It does look like a hack on Binance," he said.

Binance co-founder Yi He pledged that the company would compensate users for any losses, but offered no further details about the incident. "Binance will cover all hacking losses," Yi He said.

The company also sought to reassure customers that their assets remained secure. "Rest assured that user funds are completely safe," a Binance spokesperson said.

In a statement, the exchange said its security teams were urgently examining the available information and would publish updates through its official channels once the findings had been verified.

Binance's initial assessment pointed to a possible compromise of a laptop belonging to a DevOps engineer. The attacker may have used the device to gain access to a service container and submit unauthorized withdrawal transactions, the company said.

The exchange stressed that investigators had found no indication that private keys used to access its wallets had been exposed. It promised to publish a detailed technical account after the investigation was finished.

At approximately 0030 GMT (0230 CEST) on Friday, Binance announced that deposits and withdrawals had been temporarily halted while security checks were conducted, assets frozen, and law enforcement agencies contacted.

The company warned that the estimated financial impact could rise as the investigation continued and additional funds were traced and frozen in cooperation with law enforcement, cryptocurrency issuers, blockchain intelligence companies, and industry partners.

Trading in some products was also suspended while cryptocurrency companies using Binance's platform helped freeze assets.

Tether froze approximately USD1.6 billion in its USDT cryptocurrency, according to CEO Paolo Ardoino, who said the funds were connected to the suspected attack on Binance. Circle, meanwhile, froze more than USD800 million in USDC, its CEO Jeremy Allaire said. Earlier figures put the amount frozen by Circle at around USD800 million.

USDT and USDC are stablecoins, digital currencies whose value is tied to a traditional currency, in this case the US dollar.

The US Department of Justice and the FBI had not immediately responded to requests for comment.

Possible North Korean link

The suspected Binance breach could exceed the previous record for a cryptocurrency heist by more than four times. In February 2025, hackers stole USD1.5 billion (€1.3 billion) from the Bybit platform in an attack attributed to TraderTraitor, a hacking group affiliated with North Korea.

Blockchain investigation company TRM Labs said on Thursday that it had a high degree of confidence that TraderTraitor was also behind the Binance incident, citing what it described as strong intelligence from both on-chain and off-chain sources.

The firm said several elements of the suspected attack resembled previous cyber operations linked to North Korea. TraderTraitor is believed to be part of the Lazarus Group, which came to prominence in 2014 after being accused of hacking Sony Pictures in retaliation for the release of The Interview, a film that mocked North Korean leader Kim Jong Un.

Zhao, who established Binance in 2017, also commented on the company's responsibility toward its customers. "As a shareholder, I expect all user funds will be fully covered," he said.

He left the CEO position in 2023 after pleading guilty to failing to prevent money laundering on the platform. US President Donald Trump pardoned him in 2025.

Zhao and Binance have been prominent supporters of cryptocurrency ventures associated with Trump and his family.

Cryptocurrency prices fall

Reports of the suspected breach began circulating among industry observers several hours before Binance confirmed the attack. The news triggered declines across most major cryptocurrencies, while stablecoins largely avoided the sell-off because their values are designed to remain closely linked to traditional currencies.

Bitcoin fell by 3.2% on Thursday evening, dropping below USD79,000. At around 0400 GMT (0600 CEST), it was down 0.8%, having recovered from a decline of nearly 5%. Ethereum had also regained ground after falling almost 6% and was down 0.8% at the same time.

BNB, Binance's own cryptocurrency, was trading 2.7% higher after having dropped by nearly 10%.

The incident comes as concerns grow among industry observers that the expanding capabilities of artificial intelligence models could undermine cryptography and information technology security protocols.