North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever

Binance, the world’s largest cryptocurrency exchange, says hackers took about $6.3 billion in what analysts describe as the biggest crypto theft ever. The exchange says it will cover all losses.

In a security incident update on its website, Binance said its initial investigation suggests the incident “may involve a compromised DevOps engineer’s laptop.” That let an attacker reach a service container and submit unauthorised withdrawals. “We have found no evidence of any wallet private key leak,” the exchange added.

Binance says about $3 billion has been frozen on-chain so far, with help from law enforcement, stablecoin issuers and blockchain intelligence firms. It had earlier put the verified figure at $2.54 billion and warned that it could rise.

Analysts point to North Korea

US blockchain analysis firms TRM Labs and Chainalysis say the attackers were from North Korea, according to Reuters. TRM said the attackers targeted Binance wallets on 10 blockchains and moved most of the funds in about 20 minutes.

TRM said several features of the attack matched earlier heists linked to North Korea. These include the 2025 Bybit hack, which the US Federal Bureau of Investigation attributed to Pyongyang. “We make this judgment with high confidence,” TRM said.

Binance has not named the attackers. It says it is working with law enforcement “to confirm the identity of these criminals.” North Korea’s mission in Geneva and its embassy in China did not immediately respond to Reuters.

Also read: Bitget loses $351.6m to hackers, blames backend breach — links attack to North Korea

What it means for Binance users

Binance says it has temporarily suspended deposits and withdrawals while security checks continue. It has also revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds.

A separate post on X said deposits were unaffected and that Binance expected to resume withdrawals within 48 hours.

The exchange says losses will be covered from its Secure Asset Fund for Users (SAFU) and company funds. “User funds are safe,” it said.

Binance

Binance had about $162.8 billion in assets under custody and 335 million registered users, according to its 2025 annual report, as cited by Reuters. Markets reacted quickly. Bitcoin fell more than 3% to a six-week low of $76,368, and Ether dropped more than 3% to a two-month low of $2,178. BNB, Binance’s token, was down 5% over 24 hours at $709.70, according to CoinGecko.

“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks,” said Tim Sun, senior researcher at HashKey Group, per Reuters.

The hack adds to a string of thefts. Attackers stole $2.9 billion in crypto last year in nearly 150 attacks, according to TRM Labs. Bitget said in September that roughly $350 million had been stolen from its platform.

Other exchanges say they were not hit

A list circulating on social media claimed that Binance, Bybit, Bitget and Swyftx were all hacked on the same day. The other three exchanges have denied it.

“Bybit is not affected,” the exchange said. Bitget said it “remains secure and fully operational.” Swyftx said its security team “has found no evidence of a breach.”

Binance.US said it is a separate, independent platform and is not affected. Crypto.com and Blockchain.com also said their platforms are operating normally. Coinbase said it was unaffected and is monitoring the situation, per Reuters.

Figures also differ. Watcher.Guru posting on X, put the theft at over $5.6 billion, while binance’s own estimate is around $6.3 billion.

Read also: More than an exchange: Binance marks 323 million users, $156 trillion in transactions on 9th anniversary

A separate hack at Polymarket

Polymarket, the prediction market, also halted trading on its international platform on Thursday after a security incident involving a third-party provider. Reuters described it as unrelated to the Binance attack.

According to security firm Hudson Rock, as reported by Cyber Kendra, a malicious script served through web performance firm DebugBear searched for logged-in trading sessions and sold users’ positions. One trader said he lost about $800,000. DebugBear said on X it was “impacted by an ongoing security incident.”

Polymarket says it has fixed the issue and referred the matter to law enforcement. “Anyone who has been impacted will be made whole,” it said. It has not said how many accounts were affected or how much was taken.

Back at Binance, the exchange says it will publish a detailed technical post-mortem and an updated Proof of Reserves once its investigation and remediation are complete.