Photo Credit: Getty Images
Cryptocurrency exchange Binance is investigating a massive security breach after approximately $6.3 billion in digital assets were reportedly affected, in what analysts believe could become the largest cryptocurrency theft ever recorded.
The world's largest cryptocurrency exchange confirmed the incident on Thursday, saying its initial investigation suggested that an engineer's laptop had been compromised. The attacker allegedly exploited access to internal systems to initiate unauthorised withdrawals.
However, subsequent investigations uncovered additional potential points of entry, suggesting the incident involved a more complicated attack than initially suspected.
Binance co chief executive Richard Teng said the breach was not simply the result of one employee's permissions being misused. He also stated that investigators had found no evidence that private wallet keys had been leaked.
The company said approximately half of the affected assets had been frozen, although a substantial amount remained under the control of the attackers. Binance promised to cover all losses and cooperate with law enforcement agencies to identify those responsible.
The scale of the incident has attracted attention from cybersecurity and blockchain analysis firms. Check Point and Chainalysis have expressed high confidence that the attack is linked to TraderTraitor, a North Korean hacking operation also associated with the Lazarus Group.
The same group has previously been blamed for major cryptocurrency thefts, including the $1.5 billion Bybit exchange hack in 2025.
TRM Labs also identified similarities between the Binance incident and previous attacks attributed to North Korean operatives. Its global head of policy, Ari Redbord, described the breach as a watershed moment for the cryptocurrency industry.
Cybersecurity experts have warned that hackers are increasingly targeting the systems and employees responsible for authorising transactions rather than attempting to obtain wallet passwords or private keys directly.
The incident has also raised concerns about the vulnerability of cryptocurrency exchanges, which collectively hold enormous amounts of digital wealth.
Binance, founded in China in 2017, has more than 300 million registered users worldwide. The company previously reported holding more than $160 billion in customer assets in 2024.
Several major cryptocurrency firms responded by freezing assets believed to be connected to the breach. Tether and Circle reportedly froze approximately $2.4 billion combined, while World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said it had worked with partners to restrict stolen funds.
Binance temporarily disabled withdrawals while reviewing the security of its systems. Its co chief executive Yi He thanked cryptocurrency issuers for assisting with the freezing efforts.
The breach also affected market confidence. Bitcoin fell by more than four percent following alerts about the incident, while Ethereum and Solana also recorded significant declines.
The smaller American platform Binance.US said it was not affected, while Coinbase confirmed that its operations remained unaffected.
The incident comes amid growing concerns about cryptocurrency thefts linked to North Korea. Western security agencies have previously alleged that stolen digital assets help finance the country's weapons programmes, although Pyongyang has repeatedly denied involvement in cyberattacks.
Binance said it would publish a detailed account of the incident once investigations were complete. For the wider industry, the breach is a reminder that even the largest digital asset platforms remain attractive targets for increasingly sophisticated cybercriminals.
