Binance said on Thursday that $6.3bn (£4.7bn) in digital assets has been affected by what has been described as the "largest hack in history." The world's biggest crypto exchange said about half of those assets have been frozen with the help of other platforms, and that it will "cover all losses."
Early checks indicate the incident may have involved an engineer's laptop that had been compromised, allowing an attacker to make unauthorised withdrawals, Binance said.
Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor. The firms are TRM Labs and Chainalysis. TRM Labs said several elements of the attack resemble earlier North Korean-linked incidents, including the 2025 hack on the Bybit exchange, which was worth $1.5bn. Chainalysis said it has "high confidence" that the North Korean group is linked to the hack. Binance did not directly respond to questions about possible North Korean links. It said it is "working closely with our law enforcement partners to confirm the identity of these criminals."
TRM Labs' global head of policy, Ari Redbord, told the BBC the attacker still holds a large sum of stolen assets, so efforts to trace and recover the funds are ongoing.
Binance co-chief executive Yi He thanked crypto issuers for freezing assets and said withdrawals are disabled "until the environment is confirmed to be secure."
Tether said it has frozen around $1.6bn related to the potential hack. Circle said it has frozen more than $800m in assets linked to the incident. Crypto exchange Coinbase said it was unaffected and is monitoring the situation.
Bitcoin fell by more than 4% after the alerts, according to the report, and other major cryptocurrencies, including Ethereum and Solana, also dropped sharply.