On Thursday, Binance, the leading cryptocurrency exchange, announced that approximately $6.3 billion (£4.7 billion) in digital assets have been compromised in what is believed to be the most significant hack in cryptocurrency history.
The exchange reported that nearly 50% of these funds have been frozen, although a substantial portion remains with the hackers. Binance has reassured users that it will “cover all losses.”
The company indicated that preliminary evaluations pointed to the breach of an engineer’s laptop, which facilitated unauthorized withdrawals. However, further investigation revealed additional vulnerabilities.
Two analytical firms have connected this incident, surpassing the previous record of a $1.5 billion hack at the Bybit exchange in 2025, to a North Korean hacking group known as TraderTraitor.
Check Point, a cybersecurity organization, noted that this group is also recognized as the Lazarus Group, which has been implicated in the 2025 Bybit breach.
Jayant Dave, chief information security officer at Check Point, stated that the losses cited by Binance mark it as “the largest crypto theft on record.”
TRM Labs, a firm specializing in AI-driven investigations, reported that various aspects of the Binance breach are similar to previous attacks associated with North Korea, including the Bybit incident.
Ari Redbord, the global head of policy at TRM Labs, remarked to the BBC that the Binance hack represents a “watershed moment” unprecedented in the cryptocurrency space.
The hacker still retains a significant amount of stolen assets, indicating that efforts to trace and recover these funds are ongoing, Redbord emphasized.
Founded in China in 2017, Binance allows users to trade digital currencies and is estimated to serve over 300 million registered users globally.
In a statement from 2024, the company revealed that it manages over $160 billion in assets.
The platform has faced regulatory scrutiny across various jurisdictions.
Chainalysis, another crypto analytics firm, also expressed “high confidence” in the link between the North Korean group and the hack.
For several years, operatives associated with North Korea have targeted cryptocurrency platforms for substantial digital token thefts.
Western security agencies have stated that the illicit funds are utilized to support North Korea’s nuclear and missile development initiatives.
The North Korean regime has previously denied any involvement in hacking activities.
Eric Jardine, Head of Research at Chainalysis, urged all exchanges to stay vigilant, given that crypto platforms are appealing targets due to their high-value assets.
Binance did not directly respond to BBC inquiries regarding any potential associations of the incident with North Korea, but asserted, “We are cooperating closely with law enforcement to identify these criminals and bring them to justice.”
This breach pertains to Binance.com, whereas the smaller platform Binance.US, which caters specifically to American users, stated that it was unaffected by the situation.