A stunning $6.3bn theft from Binance has jolted the crypto world, with analysts calling it the largest hack ever to hit a digital-asset exchange.
The scale of the breach is likely to sharpen investor focus on the dangers of holding cryptocurrency, particularly on centralised platforms.
US blockchain analysis firms TRM Labs and Chainalysis said the hackers responsible were from North Korea.
According to TRM Labs, the attackers hit Binance wallets across 10 blockchains and moved most of the money in roughly 20 minutes.
Binance said it and its partners had already frozen some of the stolen assets, with about $3bn located so far. The exchange did not detail the status of the remaining $3.3bn, while co-founder Yi He said Binance would cover “all hacking losses”.
Binance said deposits were not affected and that it expects to restore withdrawal services within the next 48 hours.
TRM Labs said the operation bore hallmarks seen in previous heists tied to North Korea, including a 2025 attack on crypto-exchange Bybit that the US Federal Bureau of Investigation attributed to Pyongyang.
“We make this judgment with high confidence,” TRM said.
North Korea’s mission in Geneva and its embassy in China did not immediately respond to Reuters requests for comment.
Chainalysis and other industry specialists said the episode could stand as the biggest crypto heist on record.
“It’s the biggest hack in history,” said Aravind Srinivasan, head of large crypto market maker GSR’s systematic OTC business.
Binance has more than 335 million registered users globally
Prices slid quickly as markets opened in Asia today.
Bitcoin fell more than 3% to a six-week low of $76,368, while Ether dropped more than 3% to a two-month low of $2,178.
BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5% over the past 24 hours at $709.70, according to market aggregator CoinGecko.
In extended US trading, shares of crypto exchange Coinbase Global sank 4.8%, and those of bitcoin buyer Strategy slipped nearly 6%.
Binance, which enables users to buy, sell and trade digital assets, has more than 335 million registered users worldwide and reported about $160bn in assets under custody in its 2024 annual report.
Binance said early findings indicated the breach may have begun with a compromised laptop used by one of its engineers, allowing an intruder to reach one of its systems and execute unauthorised withdrawals.
“The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” Binance said.
Bitcoin dropped more than 3% to a six-week low
Analysts said the implications could extend well beyond the stolen funds, landing at a time when crypto markets have already faced headwinds from higher US interest rates and waning demand from exchange-traded fund buyers.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks,” said Tim Sun, senior researcher at HashKey Group in Hong Kong.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8bn in assets under custody as of the exchange’s 2025 annual report.
“User funds remain safe,” Binance said in a statement.
Binance operates a secure asset fund for users — a reserve held entirely in bitcoin — which its website says is designed to protect user assets in the event of security breaches.
“It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them,” said Bernardo Brites, CEO of Trace Finance, a payments and stablecoin infrastructure company.
“My view is that users will move away from smaller and medium-sized exchanges, (it is) becoming too risky to park your money somewhere that couldn’t cover a hack of meaningful size.”
Stablecoin issuer Tether said it had frozen nearly $1.57bn in assets connected to the incident, while Circle said it froze more than $800m.
World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said yesterday it had coordinated with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack.
Yi said $27m in stablecoins and about $2m worth of World Liberty tokens had been frozen.
Ripple also froze roughly $200m in funds, Yi said.
Jack McDonald, senior vice president of stablecoins at Ripple, said the firm was tracking reports of a potential exploit involving Binance, freezing impacted funds and working with relevant parties.
Binance co-founder Changpeng Zhao said in a post on X that the incident ‘looked like a hack’
Miguel Morel, CEO of blockchain intelligence firm Arkham, said blockchain data suggested that billions of dollars had been taken from Binance by an unknown actor.
The breach is the latest in a series of high-profile crypto thefts. TRM Labs researchers said attackers stole $2.9bn worth of cryptocurrency last year across nearly 150 incidents.
In September, crypto exchange Bitget said roughly $350m in crypto had been stolen from its platform, highlighting the sector’s ongoing exposure to hackers.
Authorities have also warned that organised crime groups are increasingly turning to cryptocurrencies to move money across borders outside traditional financial channels.
Binance.US, which operates separately, said the security incident did not affect its exchange.
Coinbase said it was not impacted and was watching developments.
Separately, earlier yesterday, prediction market operator Polymarket briefly paused trading after a security incident involving a third-party provider. Trading later resumed, and the company said it would fully reimburse affected traders.
