Binance says a security incident affected about $6.3 billion in digital assets, with roughly half frozen. Two analytics firms attribute the attack to a North Korean unit, though no link is confirmed.
Binance, the world's largest cryptocurrency exchange, said a security incident affected an estimated $6.3 billion in digital assets, roughly half of which has been frozen, in what would be the largest theft in the industry's history.
The exchange said early findings point to a compromised laptop belonging to a DevOps engineer, which allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Deposits continued to operate normally; withdrawals were suspended and the affected address authorization revoked.
Binance said it will cover all losses through its Secure Asset Fund for Users and corporate funds, and that it found no evidence of a private key leak. Co-founder Yi He said the exchange expected to begin restoring withdrawals within 48 hours. A technical post-mortem and updated proof-of-reserves are promised once the investigation is complete.
Freezes and market reaction
Stablecoin issuers moved quickly. Circle chief executive Jeremy Allaire said the company froze more than $800 million in USD Coin tied to the incident, while Tether's Paolo Ardoino said his firm froze more than $1.5 billion. Ripple also acted. Binance put the verified total frozen at $2.54 billion. Circle shares fell about 5% in after-hours trading.
Bitcoin fell more than 4% to around $78,000 as the disclosure weighed on crypto markets.
Attribution: suspicion, not conclusion
Two blockchain analytics firms have attributed the attack to a North Korean unit known as TraderTraitor. TRM Labs said several elements resemble earlier North Korean-linked incidents, including the $1.5 billion Bybit hack in 2025. Chainalysis said it holds "high confidence" in the link.
No group has claimed responsibility. Binance did not directly answer questions about a North Korean connection, saying only that it is working with law enforcement partners "to confirm the identity of these criminals and bring them to justice." The attribution should be treated as an assessment by private analysts, not a confirmed finding.
What remains unresolved
How much of the $6.3 billion is permanently lost depends on recovery and on whether Binance's reimbursement holds without straining its balance sheet. The exact intrusion path, the time elapsed before detection, and the full list of affected chains and assets are not yet public. Binance.US said its platform was unaffected.
The incident lands on an exchange that has spent years under regulatory scrutiny, including a 2023 money laundering settlement that saw chief executive Changpeng Zhao resign. If the North Korean link is confirmed, it would extend a pattern of state-linked crypto theft that has grown steadily more ambitious in scale.