Hackers stole $6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would cover the losses. About half the stolen assets were quickly frozen by stablecoin issuers such as Tether, Circle and the Trump-backed World Liberty Financial.
The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation had attributed to Pyongyang.
“TRM attributes the attack to … North Korea’s elite hacking unit,” the firm said in an analysis of the hack posted to its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.
North Korea routinely denies that. Its mission in Geneva and embassy in China did not immediately respond to Reuters’ requests for comment.
Binance said user funds were safe and that it was working with partners to freeze some of the affected assets, with about $3 billion located so far. It expects to resume withdrawal services in the next 48 hours.
It did not mention the status of the remaining $3.3 billion.
“Your money is safe and we’re covering every loss,” co-CEO Richard Teng said on X. “Our investigation has not attributed responsibility to any individual.”
“It’s the biggest hack in history,” Aravind Srinivasan at market maker GSR said as crypto prices fell broadly.
