Binance says $6.3bn security breach could be biggest crypto heist

Binance, the world’s largest cryptocurrency exchange, has reported a security breach involving an estimated $6.3 billion in assets, in what analysts say could be the biggest cryptocurrency theft on record.

The exchange said it had worked with industry partners to freeze the affected funds, recovering or locating about $3 billion so far. It did not provide details about the remaining $3.3 billion. Binance co-founder Yi He said the company would cover “all hacking losses”.

An initial investigation indicated that the attack may have begun after a hacker gained access to a laptop belonging to one of the exchange’s engineers. This allegedly allowed the attacker to access one of Binance’s systems and carry out unauthorised withdrawals, the company said.

US blockchain analytics firm TRM Labs later attributed the attack to North Korean hackers. It said an attacker had transferred approximately $6.36 billion from Binance wallets across 10 blockchains on October 10, with most of the transactions taking place within about 20 minutes.

“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgement with high confidence,” the firm said in a blog post.

The breach triggered a sell-off in cryptocurrency markets during early Asian trading on Friday. Bitcoin fell more than 3 per cent to a six-week low of $76,368, while ether dropped by a similar margin to a two-month low of $2,178.

BNB, a token originally launched as Binance Coin and used to pay fees on the exchange, lost 5pc over the previous 24 hours to trade at $709.70, according to CoinGecko. Shares of US crypto exchange Coinbase Global fell 4.8pc, while those of bitcoin investor Strategy dropped nearly 6pc in extended trading.

Industry experts said the incident could rank as the largest cryptocurrency heist to date. Aravind Srinivasan, head of the systematic over-the-counter business at crypto market maker GSR, described it as “the biggest hack in history”.

Analysts warned that the breach could further undermine confidence in digital assets, particularly as the cryptocurrency market was already facing pressure from higher US interest rates and weaker demand from exchange-traded fund investors.

“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks,” said Tim Sun, a senior researcher at Hong Kong-based HashKey Group.

Binance, which enables users to buy, sell and trade digital assets, has 335 million registered users worldwide. Its 2025 annual report showed that it held about $162.8 billion in assets under custody.

“User funds remain safe,” the exchange said in a statement, adding that deposits and withdrawals had been temporarily suspended as a precaution while its security teams examined the incident, secured wallet infrastructure and traced the affected assets with support from law enforcement and industry partners.

Binance operates a Secure Asset Fund for Users, a reserve held entirely in bitcoin and intended to protect customers in the event of security breaches, according to the exchange’s website.

Bernardo Brites, chief executive of payments and stablecoin infrastructure company Trace Finance, said the growing use of artificial intelligence was making it harder for companies to defend against cyberattacks.

He said users might increasingly avoid smaller and mid-sized exchanges because of concerns about their ability to cover substantial losses resulting from hacks.

Several cryptocurrency companies said they had frozen funds linked to the incident. Stablecoin issuer Tether froze nearly $1.57 billion in assets, while Circle froze more than $800 million.

World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said on Thursday that it had worked with crypto custodian BitGo to freeze funds stolen in the attack.

Yi said $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen. Crypto firm Ripple also froze approximately $200 million in funds, she added.

Jack McDonald, Ripple’s senior vice president of stablecoins, said the company was monitoring reports of a potential exploit involving Binance and was freezing affected funds while coordinating with relevant parties.

Miguel Morel, chief executive of blockchain intelligence firm Arkham, said available data suggested that billions of dollars had been stolen from Binance by an unidentified attacker.

The incident is the latest in a series of major cryptocurrency thefts. Attackers stole $2.9 billion worth of digital assets in nearly 150 incidents last year, according to TRM Labs.

In September, cryptocurrency exchange Bitget reported that about $350 million in crypto assets had been stolen from its platform, highlighting the sector’s continued exposure to cyberattacks.

Authorities have also warned that organised criminal groups are increasingly using cryptocurrencies to transfer money across borders outside the traditional financial system.

Binance.US, a separate exchange, said it had not been affected by the breach. Coinbase also said its platform was unaffected and that it was monitoring the situation.

In a separate incident on Thursday, prediction market operator Polymarket temporarily suspended trading following a security issue involving a third-party provider. Trading later resumed, with the company saying it would fully reimburse affected users.