Hackers stole $6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in a theft that analysts blamed on North Korea and said could be the largest financial heist of all time.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would use company funds to cover the losses. Stablecoin issuers including El Salvador-based Tether and the Trump-backed World Liberty Financial froze about half of the stolen assets.
The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about $3bn located so far. It said earlier yesterday it expected to resume withdrawal services in the next 48 hours. It did not mention the status of the remaining $3.3bn.
Binance said it had set aside around $6.34bn of company funds internally to cover the losses. The company has a $1bn bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website. Binance founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than $1bn.
“We NEVER use any customer funds, so they are not impacted,” Binance co-CEO Richard Teng said in a post on X.
Teng described the breach as a ‘complex attack’ that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete traces and evidence of its activity as it went along, “making it more difficult for us to trace and investigate.”
The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected wallet in a way that did not pass through normal approval controls, Teng said.
Stablecoin issuer Tether said it had frozen nearly $1.57bn in assets linked to the incident, while Circle froze more than $800 million.
The incident adds to a string of crypto thefts. Last year, attackers stole $2.9bn worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.
“TRM attributes the attack to ... North Korea’s elite hacking unit,” the firm said in an analysis on its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
“This incident is almost certainly the single largest known theft of any kind,” British blockchain analysts Elliptic said.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.
North Korea routinely denies that. Its mission in Geneva and embassy in China did not respond to requests for comment.
Binance is working with the Federal Bureau of Investigation and the United States Secret Service (USSS), a person familiar with the situation told Reuters.
&uuid=(email))