Binance says it has frozen about half of the $6.3bn (£4.7bn) stolen in a "complex" hack, which it believes is a record heist. The exchange said $3bn of its stolen digital assets had been secured, but many funds remain in the hands of unidentified hackers.
Binance first said a compromised engineer's laptop may have allowed unauthorised withdrawals. Co-CEO Richard Teng later said "This was not carried out by one person," and that the investigation had uncovered additional points of breach. He also said the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went."
Several analytics firms have linked the hack to a North Korean hacking unit. Chainalysis said it had "high confidence" that a North Korean actor is linked to the hack. TRM Labs said several elements resembled earlier North Korean-linked incidents, including the 2025 Bybit hack. North Korea has denied involvement.
The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover the stolen funds. Binance said it is working with the FBI.
Binance said it has set aside more than $6.34bn in company funds to cover the losses. It has told users "your money is safe, and we're covering every loss." Legal expert Daniel Tunkel of Edwin Coe said that customers' ability to recover losses would "come down to what [customers] have been promised in their contracts."
Bitcoin fell 5% to $76,800 in New York trading on Friday. Coinbase shares fell 12%, and Robinhood shares fell 7.8%.