Binance - victim of the largest cyberattack in history: hackers stole $6.3 billion

Hackers stole $6.3 billion worth of cryptocurrencies from Binance, the world's largest digital asset exchange, in an unprecedented cyberattack that cybersecurity specialists attribute to North Korea. The incident, considered the largest cryptocurrency theft ever recorded, risks undermining investor confidence in the digital asset market.

The announcement triggered declines in cryptocurrency prices, while Binance suspended withdrawals and assured users that it would fully cover the losses. Approximately half of the stolen assets were quickly frozen by stablecoin issuers, including Tether, Circle and World Liberty Financial, a company backed by US President Donald Trump.

Most of the attack unfolded over approximately 20 minutes, beginning on Thursday evening, and bears similarities to other large-scale cyber operations attributed to North Korea, according to US blockchain analysis companies TRM Labs and Chainalysis.

According to TRM Labs, the attackers managed to issue commands that caused digital wallets used by Binance to transfer funds to addresses controlled by hackers. The method resembles the 2025 attack on the Bybit platform, which the United States Federal Bureau of Investigation (FBI) attributed to the authorities in Pyongyang.

In an analysis published on its website, TRM Labs identified an elite North Korean hacking unit as responsible. Both TRM Labs and Chainalysis stated that they had a high level of confidence in the conclusion that the attack was organized by North Korea.

US and South Korean authorities, along with cybersecurity experts, have maintained for several years that the Pyongyang regime uses state-affiliated hacking groups for espionage operations, financial theft and revenue generation.

North Korea has repeatedly rejected such accusations. The North Korean diplomatic mission in Geneva and the country's embassy in China did not immediately respond to requests for comment sent by Reuters.

• Binance promises to cover losses. Approximately $3.3 billion remains unaccounted for

Binance representatives announced that users' funds are safe and that the platform is working with several partners to identify and freeze the stolen assets. So far, approximately $3 billion has been located, and the company estimates that withdrawal services will resume within the next 48 hours.

However, Binance has not provided information about the whereabouts of the remaining $3.3 billion.

Richard Teng, co-CEO of Binance, stated on the X platform that customer funds are protected and that the company is committed to covering all losses. He also specified that the internal investigation has not, at this point, identified a person responsible for the attack.

Aravind Srinivasan, a representative of market-making company GSR, described the incident as the largest cyberattack in history, against the backdrop of widespread declines in the cryptocurrency market.

Bitcoin fell to $76,368, its lowest level in six weeks, while ether depreciated by more than 3%, reaching $2,178, its lowest level in two months. Markets subsequently stabilized.

BNB, the token initially launched under the name Binance Coin and used, among other purposes, to pay fees on the platform, lost 5% over the past 24 hours, reaching $709.70, according to CoinGecko data.

The effects of the attack also extended to publicly listed companies operating in the cryptocurrency sector. Shares of Coinbase Global, a company that stated it had not been affected by the incident, fell by 4.8%, while shares of Strategy, a company known for its bitcoin purchases, declined by nearly 6% in trading after the close of the US stock market session.

• A compromised laptop could have been the starting point of the attack

The initial findings of Binance's investigation indicate the possibility that the attack began with the compromise of a company engineer's laptop. Access obtained through the device may have allowed the attackers to penetrate one of the platform's systems and initiate unauthorized withdrawals.

Binance's security team is currently attempting to reconstruct the entire course of the attack, starting from the compromised computer, considered a possible entry point into the company's infrastructure.

Mark Karpeles, former director of the Japanese platform Mt. Gox, which collapsed approximately 12 years ago following the theft of bitcoin worth $500 million, believes that the hackers most likely gained access to the private keys associated with at least two Binance wallets.

According to him, Binance appears to have distributed its assets across several systems so that the compromise of one of them would not affect the entire financial infrastructure. Nevertheless, the volume of funds managed by the company means that even an attack limited to part of its systems can generate considerable losses.

Beyond the direct financial damage, analysts warn that the incident could have consequences for the entire cryptocurrency industry, already affected by high interest rates in the United States and declining demand from investors in exchange-traded funds (ETFs).

Tim Sun, principal researcher at Hong Kong-based HashKey Group, believes that the attack could further reduce risk appetite and prompt investors to reassess the safety of assets held on centralized trading platforms.

• The value of the theft exceeds Binance's protection fund by more than six times

Binance, a platform that allows the purchase, sale and trading of digital assets, had 335 million registered users worldwide and managed assets worth approximately $162.8 billion, according to its 2025 annual report.

The company has a user protection fund called the Secure Asset Fund for Users (SAFU), established as a reserve to cover potential losses caused by security incidents.

According to information published on Binance's website, the fund is worth $1 billion and is held entirely in bitcoin.

The amount stolen in the attack thus exceeds the value of the security reserve by more than six times.

Richard Teng specified that the losses would be covered both from this fund and from the company's own financial resources.

Meanwhile, several companies in the cryptocurrency industry have intervened to freeze assets associated with the attack.

Tether announced the freezing of funds worth nearly $1.57 billion, while Circle blocked assets worth more than $800 million.

World Liberty Financial stated that it had collaborated with custody service provider BitGo to freeze the affected funds.

Yi He, co-founder of Binance, specified that stablecoins worth $27 million and World Liberty tokens valued at approximately $2 million had been frozen.

According to her, Ripple also froze funds worth approximately $200 million.

• Cryptocurrency industry affected by a series of large-scale cyberattacks

The Binance incident adds to a succession of cyber thefts that have affected the digital asset industry in recent years and highlighted vulnerabilities in the infrastructures used to manage and transfer cryptocurrencies.

According to TRM Labs data, attackers stole cryptocurrencies worth a total of $2.9 billion last year, in nearly 150 separate incidents.

In September, the Bitget trading platform also announced the theft of digital assets valued at approximately $350 million.

The new attack on Binance, through the unprecedented value of the stolen funds and the alleged involvement of North Korean hackers, once again draws attention to the risks associated with holding very large volumes of digital assets within the infrastructures of centralized platforms, in a sector where security incidents continue to generate billions of dollars in losses.