SINGAPORE/TOKYO -- Hackers stole US$6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets. Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would cover the losses. About half the stolen assets were quickly frozen by stablecoin issuers such as Tether, Circle and the Trump-backed World Liberty Financial. The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to U.S. blockchain analysis firms TRM Labs and Chainalysis. TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the U.S. Federal Bureau of Investigation had attributed to Pyongyang. “TRM attributes the attack to ... North Korea’s elite hacking unit,” the firm said in an analysis of the hack posted to its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible. ‘Biggest hack in history’ North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to U.S. and South Korean authorities as well as cybersecurity experts. North Korea routinely denies that. Its mission in Geneva and embassy in China did not immediately respond to Reuters’ requests for comment. Binance said user funds were safe and that it was working with partners to freeze some of the affected assets, with about $3 billion located so far. It expects to resume withdrawal services in the next 48 hours. It did not mention the status of the remaining $3.3 billion. “Your money is safe and we’re covering every loss,” co-CEO Richard Teng said on X. “Our investigation has not attributed responsibility to any individual.” “It’s the biggest hack in history,” Aravind Srinivasan at market maker GSR said as crypto prices fell broadly. Bitcoin hit a six-week low of $76,368 and ether ETH= fell more than 3 per cent to a two-month low of $2,178 before markets stabilized. BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5 per cent over the past 24 hours at $709.70, according to CoinGecko, while shaky confidence hit listed crypto exchange shares. Shares in crypto exchange Coinbase Global, which said it was unaffected, slid 4.8 per cent, while those of bitcoin buyer Strategy MSTR.O fell nearly 6 per cent in extended U.S. trading. Compromised laptop An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance’s engineers, which let an attacker gain access to one of its systems and make unauthorized withdrawals, Binance said. “Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” Binance said. Mark Karpeles, former chief of defunct Tokyo-based bitcoin exchange Mt Gox, which collapsed a dozen years ago after $500 million in bitcoin was stolen, said attackers probably accessed private keys for at least two Binance wallets. “Binance appears to have split its assets across multiple systems, ensuring a hack can only affect a part of the assets, but even so a single hack is a large loss,” he said. Beyond the potential loss of assets, the security breach was likely to have wider ramifications for crypto, which had already been under pressure due to higher U.S. interest rates and softer demand from exchange-traded fund buyers, analysts said. “It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges,” said Tim Sun, senior researcher at HashKey Group, based in Hong Kong. Hack size tops Binance secure asset fund Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8 billion in assets under custody as of the exchange’s 2025 annual report. The crypto exchange runs a secure asset fund for users, which is a $1 billion reserve held entirely in bitcoin that is intended to protect user assets in cases of security breaches, according to its website. Co-CEO Teng said that “and company funds” will cover losses. Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million. World Liberty Financial said it worked with custodian BitGo to freeze funds, and Binance co-founder Yi He said $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen. Crypto firm Ripple also froze roughly $200 million in funds, Yi said. The incident adds to a string of crypto thefts. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs. In September, cryptocurrency exchange Bitget said roughly $350 million in crypto had been stolen from its platform, underscoring the industry’s vulnerability to hackers. Reporting by Tom Westbrook, Ankur Banerjee and Rae Wee in Singapore, Summer Zhen in Hong Kong, Rocky Swift in Tokyo, Vallari Srivastava and Anusha Shah in Bengaluru and Mrinmay Dey in Mexico City; Writing by Scott Murdoch and Tom Westbrook; Editing by Jamie Freed, Stephen Coates and Jan Harvey, Reuters
