Cryptocurrency exchange Binance says digital assets worth $6.3 billion have been affected by a security breach that could rank among the largest cryptocurrency hacks in history.
The world’s biggest cryptocurrency exchange said on Thursday that about half of the affected assets had been frozen, while a significant portion remained in the hands of the attackers. Binance added that it would cover all losses arising from the incident.
Preliminary investigations suggest that the breach may have involved a compromised engineer’s laptop, which allegedly enabled an attacker to carry out unauthorised withdrawals, the company said.
Two cryptocurrency analytics firms have linked the incident to TraderTraitor, a North Korean hacking group. The suspected involvement of the group would make the incident significantly larger than the $1.5 billion hack of cryptocurrency exchange Bybit in 2025.
TRM Labs, an AI-powered blockchain investigations company, said several aspects of the Binance incident resembled previous attacks linked to North Korea, including the Bybit breach.
The firm’s global head of policy, Ari Redbord, described the incident to the BBC as a “watershed moment” for the cryptocurrency industry, saying it was unlike anything the sector had previously experienced.
Redbord warned that the attacker still controlled a substantial amount of the stolen assets, meaning efforts to trace and recover the funds were continuing.
Chainalysis, another cryptocurrency analytics firm, said it had “high confidence” that the North Korean group was connected to the attack.
North Korean-linked operatives have been accused of targeting cryptocurrency companies in recent years to steal large quantities of digital assets. Western security agencies have previously alleged that proceeds from such thefts help finance North Korea’s nuclear weapons and missile programmes.
Pyongyang has repeatedly denied involvement in cryptocurrency hacks.
Chainalysis head of research, Eric Jardine, urged cryptocurrency exchanges to strengthen their vigilance, warning that the large value of assets held on the platforms makes them attractive targets for cybercriminals.
Binance did not directly address questions from the BBC about the suspected North Korean connection. However, the company said it was working with law enforcement agencies to identify those responsible and bring them to justice.
