Binance, the world’s largest cryptocurrency exchange, has reported a massive cyberattack in which hackers allegedly stole approximately $6.3 billion worth of digital assets. The incident is being described as potentially the biggest cryptocurrency theft in history, with blockchain intelligence companies pointing to a suspected North Korean hacking group.
The company said it had allocated more than $6.34 billion from its own funds to cover the losses and had begun efforts to recover the stolen assets. Working with blockchain partners, Binance has also managed to freeze approximately $3 billion worth of the affected funds.
The exchange has assured customers that it will cover all losses and has been providing regular updates about its investigation.
Binance co-CEO Richard Teng said in a video message posted on X on Friday that the company was working around the clock to resolve the situation.
Meanwhile, U.S. President Donald Trump confirmed that American authorities were investigating the incident. When asked whether North Korea was involved, he said officials were looking into the possibility.
1. North Korean Hacking Group Suspected of Carrying Out the Attack
Binance said its initial investigation indicated that a compromised laptop might have played a role in the security breach. However, further examination revealed additional possible entry points used by the attackers.
Blockchain intelligence company TRM attributed the incident to TraderTraitor, a sophisticated hacking group believed to be associated with North Korea. The firm said it had a high level of confidence in its assessment.
According to TRM, approximately $6.36 billion was transferred from Binance wallets across 10 different blockchain networks, with most of the funds moved within roughly 20 minutes.
Another blockchain analysis firm, Chainalysis, also suggested that TraderTraitor was likely responsible for the attack.
Binance has not officially confirmed the hackers' identities. A company spokesperson said the exchange was cooperating with law enforcement agencies to identify those responsible and bring them to justice.
Experts say North Korea has increasingly relied on cryptocurrency theft and other illegal cyber activities to generate foreign currency. These activities are believed to help support its economy and finance government programmes despite international sanctions.
South Korea's intelligence agency previously estimated that North Korean hackers had stolen approximately 1.5 trillion won, equivalent to around $1.1 billion, in cryptocurrency and other digital assets over five years, with more than half of the amount stolen in 2022.
2. Attack Could Become the Biggest Cryptocurrency Theft on Record
Several blockchain companies and cybersecurity experts have described the Binance incident as the largest cryptocurrency theft recorded so far.
Although approximately half of the stolen assets have reportedly been frozen, analysts believe hackers may already be transferring and converting some of the remaining funds.
Cryptocurrency analyst Garrick Hileman explained that criminals often use crypto-mixing services to combine stolen digital currencies with other transactions, making it more difficult for investigators to trace their movements.
However, it remains uncertain how long the attackers would need to convert the stolen cryptocurrency into usable funds.
The incident follows another major cryptocurrency theft involving exchange Bybit, which lost approximately $1.5 billion in a cyberattack last year. The FBI attributed that incident to North Korean hackers linked to TraderTraitor.
Binance founder Changpeng Zhao noted that although the latest incident may represent the largest theft in dollar value, earlier cryptocurrency attacks, including the Mt. Gox incident, had a greater impact when measured by the amount of Bitcoin involved.
Cybersecurity specialists have also warned that increasingly sophisticated attacks, combined with developments in artificial intelligence, could make large-scale cryptocurrency thefts more frequent.
3. Security Weaknesses Raise Questions About Binance's Protection Systems
The attack has raised concerns about whether Binance had sufficient security measures and approval requirements to protect its digital wallets.
Cybersecurity expert Kok Tin Gan suggested that a security weakness may have allowed attackers to obtain a powerful access credential capable of providing extensive control over a Binance hot wallet.
Hot wallets are cryptocurrency wallets connected to the internet, allowing exchanges to process transactions and withdrawals more quickly. However, their internet connectivity can also expose them to cyber threats.
Binance co-CEO Richard Teng confirmed that the company's hot wallet had been affected by the attack.
He explained that most customer funds are stored in cold wallets, which remain offline for greater security. Assets are transferred into hot wallets when customers request withdrawals.
Teng also said Binance's technology and security teams were continuing their investigation. According to him, the attackers used sophisticated techniques and included a self-destruct mechanism that complicated efforts to investigate the breach.
The company is cooperating with law enforcement agencies, blockchain intelligence firms, cryptocurrency issuers and other exchanges to trace and recover the stolen assets.
4. Binance Promises to Cover Customer Losses
Binance has assured customers that it will take responsibility for the financial losses resulting from the incident.
The exchange said it had reserved more than $6.34 billion in company funds to cover the affected assets and was working to recover the stolen cryptocurrency.
The company also confirmed that customer deposits were not affected by the attack.
However, withdrawals were temporarily suspended as Binance worked to secure its systems. The exchange expected withdrawal services to resume within the following one or two days.