Key Takeaways
- • Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts attribute to North Korea, according to Reuters.
- • About half the stolen assets were quickly frozen by stablecoin issuers, including Tether (about $1.57 billion), Circle (more than $800 million), and World Liberty Financial, with roughly $3 billion located so far and $3.3 billion status unconfirmed.
- • Binance halted withdrawals and said it would cover all losses from company funds, with withdrawal services expected to resume within 45 hours.
- • TRM Labs and Chainalysis said they were highly confident North Korea was responsible, citing similarities to the 2025 Bybit heist that the FBI attributed to North Korea.
- • The breach may have originated from a compromised laptop belonging to a Binance engineer, and crypto prices and exchange-linked equities fell on the news.
Summary
Hackers stole $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what Reuters described as a record theft that analysts pinned on North Korea. The bulk of the heist unfolded in roughly 20 minutes beginning late on Thursday, according to Reuters. Blockchain analysis firms TRM Labs and Chainalysis said the attack bore similarities to previous large attacks blamed on North Korea. TRM said attackers were able to order wallets Binance uses to empty into hacker-controlled wallets, mirroring the 2025 heist at Bybit, which the US Federal Bureau of Investigation attributed to North Korea. Both firms said they were highly confident in the attribution. North Korea routinely denies such claims, and its mission in Geneva and embassy in China did not immediately respond to Reuters' requests for comment.
Binance said customer funds were safe and that it was working with partners and law enforcement to freeze affected assets. The exchange said about $3 billion had been located so far and did not mention the status of the remaining $3.3 billion. It expects to resume withdrawal services within 45 hours. Co-CEO Teng said company funds would cover losses, and co-founder Yi He reiterated that losses would be covered. Binance runs a secure asset fund, a $1 billion bitcoin reserve designed to protect customer assets in security breaches, according to its website. An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which allowed unauthorized withdrawals. Former Mt Gox chief Mark Karpeles said attackers probably accessed private keys for at least two Binance wallets.
Stablecoin issuers froze a significant portion of the funds. Tether said it had frozen nearly $1.57 billion linked to the incident and Circle froze more than $800 million. World Liberty Financial, working with custodian BitGo, froze $27 million in stablecoins and about $2 million in World Liberty tokens, while Ripple froze roughly $200 million, according to Yi He.
Market reaction was swift. Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178 before stabilizing. BNB fell 5% over 24 hours to $709.70, per CoinGecko. Coinbase shares slid 4.8%, though Coinbase said it was unaffected, and Strategy shares fell nearly 6% in extended US trading. Analysts said the breach could dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges. Moody's Ratings said broader implications would depend on ultimate losses, affected counterparties, asset recovery, and whether confidence across the digital-asset ecosystem is lost. The incident follows a year in which attackers stole $2.9 billion across nearly 150 attacks, according to TRM Labs, and Bitget reported about $350 million stolen in September.
Binance said customer funds were safe and that it was working with partners and law enforcement to freeze affected assets. The exchange said about $3 billion had been located so far and did not mention the status of the remaining $3.3 billion. It expects to resume withdrawal services within 45 hours. Co-CEO Teng said company funds would cover losses, and co-founder Yi He reiterated that losses would be covered. Binance runs a secure asset fund, a $1 billion bitcoin reserve designed to protect customer assets in security breaches, according to its website. An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which allowed unauthorized withdrawals. Former Mt Gox chief Mark Karpeles said attackers probably accessed private keys for at least two Binance wallets.
Stablecoin issuers froze a significant portion of the funds. Tether said it had frozen nearly $1.57 billion linked to the incident and Circle froze more than $800 million. World Liberty Financial, working with custodian BitGo, froze $27 million in stablecoins and about $2 million in World Liberty tokens, while Ripple froze roughly $200 million, according to Yi He.
Market reaction was swift. Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178 before stabilizing. BNB fell 5% over 24 hours to $709.70, per CoinGecko. Coinbase shares slid 4.8%, though Coinbase said it was unaffected, and Strategy shares fell nearly 6% in extended US trading. Analysts said the breach could dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges. Moody's Ratings said broader implications would depend on ultimate losses, affected counterparties, asset recovery, and whether confidence across the digital-asset ecosystem is lost. The incident follows a year in which attackers stole $2.9 billion across nearly 150 attacks, according to TRM Labs, and Bitget reported about $350 million stolen in September.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.