Cryptocurrency giant Binance fell victim to the largest crypto hack in history, losing as much as $6.3 billion in digital assets late last week, before recovering as much as 90% of those assets within days. The world’s largest crypto exchange said about half of those assets had been frozen but remained with the hackers. Binance said it will “cover all losses”.
Initial checks suggested an engineer’s laptop had been compromised, allowing an attacker to make unauthorized withdrawals. However, Binance said, “subsequent investigation has uncovered additional points of breach.”
Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor. Cyber security firm Check Point said the unit is also known in the industry as Lazarus Group, which was responsible for the previous largest crypto hack for $1.5 billion on the Bybit exchange in 2025.
Check Point’s chief information officer Jayant Dave said the loses estimated by Binance make this the “largest crypto theft on record.”
The FBI stated on Saturday that North Korea was responsible for the attack. North Korea has denied involvements in both the Binance and Bybit hacks.
Binance, founded in China in 2017, allows users to trade digital assets and is estimated to have more than 300 million users worldwide. In 2024, the company stated it has more than $160 billion in assets under its custody.
In recent years, North Korean-linked operatives have been more aggressive in targeting cryptocurrency companies for large thefts of digital tokens. Western security agencies have said North Korea uses the stolen funds to finance their nuclear development and missile programs.
The hack affected Binance.com, while the smaller crypto platform Binance.US, which provides crypto trading services for American residents said its platform was not compromised by the incident.
“To be clear: the attacker simply did not use one engineers’ permissions, and this was not a single ‘one-click’ action,” said Richard Teng, Binance co-CEO. “It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have not found any evidence of any wallet private key leak.”
In lieu of the attack, other crypto platforms, including Tether and Circle, said they have frozen a total of approximately $2.4 billion of assets in response to the Binance attack.
Coinbase said it was unaffected by the incident and is monitoring the situation.
World Liberty Financial, a crypto company linked to President Donald Trump and his family, said it has worked with its partners to freeze asset funds.
The price of Bitcoin dropped more than 4% following the alerts, while the price of other cryptocurrencies including Ethereum and Solana also fell.
By Tuesday of this week, Binance announced that it had covered more than 90% of the assets stolen in last Thursday’s hack. The remaining 10% may take longer to source in the required amounts.
“Binance will absorb the financial impact of these stolen funds, not our users,” said the company in an official statement on Saturday.
Withdrawals have been restored on several of its networks after being suspended following the attack.
When asked about the hacks last weekend, President Trump claimed there had been no confirmation on the culprits.
“We’re learning about it,” said Trump. “We don’t know if it’s North Korea—but if it is, we’ll talk to North Korea about it.”
Binance said it replenished the stolen assets using various funds and its own corporate treasury.
The U.S. Secret Service said last Friday it is “working around the clock” with private sector partners “to identify, freeze, trace, and recover funds” stolen from Binance.
Crypto is a digital or virtual form of money, has no physical property or equivalent, and is accessed via digital wallets or computers.
Be the first to comment