Hackers allegedly from North Korea steal US$6.3 billion from Binance in world's biggest crypto heist
The hackers behind the raid were from North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
· CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
Hackers stole US$6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would cover the losses. About half the stolen assets were quickly frozen by stablecoin issuers such as Tether, Circle and the Trump-backed World Liberty Financial.
Binance is working with the Federal Bureau of Investigation and the United States Secret Service (USSS), a person familiar with the situation told Reuters.
"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," Binance said in a post on X.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about US$3 billion located so far.
It said earlier on Friday it expected to resume withdrawal services in the next 48 hours. It did not mention the status of the remaining US$3.3 billion.
Binance said the company had set aside around US$6.34 billion of company funds internally to cover the losses, without giving details about where the funds had come from.
The company has a US$1 billion bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website.
Binance founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than US$1 billion.
The bulk of the heist unfolded in around 20 minutes beginning late on Thursday (Oct 29) and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation had attributed to Pyongyang.
"TRM attributes the attack to ... North Korea’s elite hacking unit," the firm said in an analysis of the hack posted to its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
British blockchain analysts Elliptic also said they believed North Korea was behind the theft.
"This incident is almost certainly the single largest known theft of any kind," Elliptic said.
"BIGGEST HACK IN HISTORY"
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.
North Korea routinely denies that. Its mission in Geneva and embassy in China did not immediately respond to Reuters' requests for comment.
The US embassy in London said it had no comment on a possible investigation. The USSS did not respond to a request for comment sent via email outside of US hours.
Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, said it was "engaging closely with Binance and monitoring the incident".
"Your money is safe and we're covering every loss," co-CEO Richard Teng said on X. "Our investigation has not attributed responsibility to any individual."
"It's the biggest hack in history," Aravind Srinivasan at market maker GSR said as crypto prices fell broadly.
Bitcoin hit a six-week low of US$76,368 and ether fell more than 3 per cent to a two-month low of US$2,178 before markets stabilised.
BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5.3 per cent over the past 24 hours at US$699.54, according to CoinGecko, while shaky confidence hit listed crypto exchange shares.
COMPROMISED LAPTOP
An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said.
"Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident," Binance said. The company later added it had uncovered additional points of breach.
Beyond the potential loss of assets, the security breach was likely to have wider ramifications for the crypto sector, which had already been under pressure due to higher US interest rates and softer demand from exchange-traded fund buyers, analysts said.
"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges," said Tim Sun, senior researcher at HashKey Group.
HACK SIZE TOPS BINANCE SECURE ASSET FUND
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about US$162.8 billion in assets under custody as of the exchange's 2025 annual report.
Stablecoin issuer Tether said it had frozen nearly US$1.57 billion in assets linked to the incident, while Circle froze more than US$800 million.
World Liberty Financial said it worked with custodian BitGo to freeze funds, and Binance co-founder Yi He said US$27 million in stablecoins and about US$2 million worth of World Liberty tokens had been frozen. Crypto firm Ripple also froze roughly US$200 million in funds, Yi said.
The incident adds to a string of crypto thefts. Last year, attackers stole US$2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
In September, Bitget said roughly US$350 million in crypto had been stolen from its platform.
"The broader credit and industry implications will depend on the ultimate losses, affected counterparties, asset recovery, and importantly, whether the incident leads to wider disruption or loss of confidence across the digital-asset ecosystem," said Cristiano Ventricelli, vice president, digital assets at Moody’s Ratings.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app