Newsletters
North Korean state-sponsored hackers were behind a cyberattack that stole about $6.3 billion from cryptocurrency exchange Binance, blockchain intelligence firm TRM assessed with “high confidence,” in what appears to be the largest crypto theft on record.
Binance said Thursday that the security incident may have begun after attackers gained access through a compromised laptop belonging to a DevOps engineer. The company said it had found no evidence that any wallet private keys were leaked.
The world’s largest cryptocurrency exchange temporarily suspended deposits and withdrawals while security checks were carried out and said it was working with blockchain partners to freeze affected assets.
About $3 billion has so far been frozen on-chain, according to Binance.
The exchange said all losses would be covered through its Secure Asset Fund for Users, or SAFU, and company funds, stressing that user funds remained safe.
Binance also said it would publish an updated Proof of Reserves after recovery efforts were completed and release a detailed technical post-mortem once its investigation was finished.
TRM said it assessed with “high confidence” that the attack was carried out by North Korea’s TraderTraitor hacking unit, which investigators have linked to the Lazarus Group.
Ari Redbord, TRM’s global head of policy, described the attack as “unprecedented” and a “watershed.”
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft,” Redbord told Al Jazeera.
Binance founder and largest shareholder Changpeng Zhao had earlier said the exchange appeared to have been hacked.
The company revoked authorization for the affected address and contacted law enforcement agencies and blockchain intelligence partners to trace and recover the funds.
“Our teams are working around the clock to resolve this issue safely and thoroughly,” Binance said in a statement to Al Jazeera.
“We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”
Bitcoin, the world’s most widely traded cryptocurrency, fell about 5% following the theft, dropping below $77,000.
Sean Foley, a crypto markets expert at Macquarie University in Sydney, said an attack on Binance could affect broader confidence among retail investors because of the exchange’s size.
“Binance is one of the largest centralised exchanges, and so a blow to confidence in them risks shocking confidence to many retail investors, which could dampen prices of crypto assets,” Foley told Al Jazeera.
Foley said the incident also underscored risks associated with centralized exchanges and could encourage more traders to move toward decentralized alternatives.
“Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes,” he said.
The estimated $6.3 billion stolen from Binance far exceeds the previous record crypto theft, set in 2025 when the North Korean state-backed Lazarus Group carried out a $1.5 billion attack on Bybit.
Cybercriminals stole $2.87 billion in cryptocurrency assets across nearly 150 hacking incidents in 2025, according to TRM’s 2026 Crypto Crime Report.
Binance was founded in China by Zhao in 2017 and has about $155 billion in assets under management, more than any other cryptocurrency exchange, according to CoinMarketCap.
Set as preferred source
Set as preferred source
1 min read
1 min read
