Photo Credit: brecorder
Binance, the world’s largest cryptocurrency exchange, has suffered a $6.3 billion cyberattack, potentially the biggest cryptocurrency theft in history, prompting emergency asset freezes, withdrawal restrictions and a sharp decline in digital asset prices.
SINGAPORE/HONG KONG: The security breach, which affected Binance wallets across 10 blockchain networks, has raised fresh concerns about the safety of digital assets held on centralised cryptocurrency exchanges.
US blockchain intelligence firms TRM Labs and Chainalysis linked the attack to North Korean hackers, citing similarities with previous large-scale cryptocurrency thefts attributed to the country.
According to TRM Labs, the attackers transferred most of the stolen funds within approximately 20 minutes, demonstrating the speed and coordination of the operation.
Binance confirmed that it had collaborated with blockchain partners to identify and freeze approximately $3 billion in affected assets. However, the status of the remaining $3.3 billion was not immediately clear.
Binance co-founder Yi He assured customers that the company would cover all losses resulting from the incident. The exchange also maintained that customer funds remained safe and said withdrawal services were expected to resume within 48 hours.
The attack has intensified concerns about cybersecurity vulnerabilities across the cryptocurrency industry, particularly as major exchanges continue to manage billions of dollars in customer assets.
Reuters+1
North Korean Hackers Suspected in Record Cryptocurrency Theft
Blockchain investigators believe the operation bears the characteristics of earlier cyberattacks attributed to North Korean hacking groups.
TRM Labs expressed high confidence in its assessment, highlighting similarities with the February 2025 attack on cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation linked to North Korea.
The Bybit incident resulted in approximately $1.5 billion in stolen cryptocurrency, making the latest Binance breach significantly larger.
North Korean authorities had not publicly responded to the allegations at the time of reporting.
The scale of the attack could make it the largest cryptocurrency theft ever recorded, according to industry analysts.
Aravind Srinivasan, head of systematic over-the-counter trading at crypto market maker GSR, described the incident as the biggest hacking operation in history.
Bitcoin, Ethereum and BNB Decline Following Binance Breach
Cryptocurrency markets reacted sharply as news of the security incident spread during Asian trading on Friday.
Bitcoin declined more than 3%, reaching a six-week low of $76,368, while Ethereum fell by a similar margin to $2,178, its weakest level in approximately two months.
BNB, the cryptocurrency originally introduced as Binance Coin, dropped 5% over 24 hours to $709.70, according to CoinGecko.
The market reaction extended beyond digital currencies, with shares of cryptocurrency exchange Coinbase Global falling 4.8% in extended US trading. Bitcoin investment company Strategy also recorded a decline of nearly 6%.
The downturn reflected growing investor uncertainty about the potential financial impact of the breach and the ability of centralised exchanges to protect customer holdings.
Compromised Engineer Laptop Investigated as Possible Entry Point
Binance’s preliminary investigation indicated that the attack may have originated from a compromised laptop belonging to one of its engineers.
The suspected breach potentially allowed attackers to access internal systems and initiate unauthorised cryptocurrency withdrawals.
However, the exchange cautioned that several factors contributed to the incident and that its cybersecurity team was still investigating the complete sequence of events.
Further findings indicated additional points of compromise, suggesting the attack may have involved a more complex intrusion than initially believed.
Binance said it was coordinating with law enforcement agencies and blockchain security specialists to trace the stolen assets and prevent further unauthorised transfers.
The company is also reviewing its security infrastructure and withdrawal procedures before restoring normal operations.
AP News+1
Tether, Circle and Ripple Help Freeze Stolen Cryptocurrency
Several major blockchain companies and stablecoin issuers joined efforts to restrict the movement of assets associated with the attack.
Tether confirmed that it had frozen approximately $1.57 billion linked to the breach, while Circle blocked more than $800 million in affected cryptocurrency.
World Liberty Financial, a digital asset company associated with US President Donald Trump and his family, also worked with cryptocurrency custodian BitGo to prevent the transfer of compromised funds.
According to Binance’s Yi He, approximately $27 million in stablecoins and another $2 million in World Liberty tokens were frozen.
Ripple also participated in the response, restricting roughly $200 million in assets linked to the incident.
Jack McDonald, Ripple’s senior vice president of stablecoins, said the company was monitoring developments and coordinating with relevant organisations to contain the financial impact.
The coordinated response highlighted the ability of certain token issuers to freeze assets, although cryptocurrencies without centralised controls can be substantially harder to recover.
Binance’s Emergency Protection Fund Faces Major Test
Binance operates the Secure Asset Fund for Users, commonly known as SAFU, as an emergency reserve designed to help protect customers during exceptional security incidents.
The fund is held in Bitcoin and is intended to provide financial support when user assets are affected by certain breaches.
However, the estimated $6.3 billion loss is considerably larger than the exchange’s approximately $1 billion protection reserve, raising questions about how the company would finance its commitment to compensate customers.
Binance has maintained that it will cover the losses through its available resources.
According to its 2025 annual report, the exchange had approximately 335 million registered users worldwide and managed around $162.8 billion in assets under custody.
The incident could therefore have broader implications for confidence in cryptocurrency trading platforms, particularly among investors concerned about counterparty exposure, exchange liquidity and financial stability.
Crypto Security Risks Raise Concerns Among Investors
Industry specialists warned that the breach could weaken confidence in centralised cryptocurrency exchanges at a time when digital asset markets were already facing pressure from elevated US interest rates and reduced demand among exchange-traded fund investors.
Tim Sun, senior researcher at Hong Kong-based HashKey Group, said major security incidents could encourage investors to reconsider the risks associated with keeping assets on trading platforms.
These concerns extend beyond the immediate possibility of stolen funds and include questions about exchange solvency, liquidity and the ability to meet withdrawal requests during periods of market uncertainty.
Bernardo Brites, chief executive of payments and stablecoin infrastructure company Trace Finance, also warned that artificial intelligence could make cybersecurity threats increasingly difficult to manage.
He suggested that investors may become less willing to use smaller and medium-sized cryptocurrency exchanges that lack sufficient financial reserves to absorb substantial losses.
The Binance incident could consequently accelerate discussions about stronger security controls, asset custody practices and transparency across the digital asset industry.
Binance Attack Adds to Growing Wave of Cryptocurrency Theft
The latest security breach follows a series of major cryptocurrency attacks targeting exchanges, wallets and blockchain infrastructure.
Research from TRM Labs indicated that hackers stole approximately $2.9 billion in cryptocurrency through nearly 150 incidents during 2025.
In September 2026, cryptocurrency exchange Bitget reported the theft of roughly $350 million in digital assets, further highlighting vulnerabilities within the industry.
Miguel Morel, chief executive of blockchain intelligence company Arkham, said transaction data indicated that billions of dollars had been removed from Binance wallets by an unidentified attacker.
Authorities have repeatedly warned that organised criminal networks are exploiting digital currencies to transfer stolen funds across international borders, creating additional challenges for financial regulators and law enforcement agencies.
Meanwhile, Coinbase stated that its operations had not been affected by the Binance breach and that it was monitoring developments.
In a separate incident, prediction market platform Polymarket temporarily suspended trading on Thursday following a security issue involving a third-party service provider.
Polymarket subsequently restored trading and said affected customers would receive full reimbursement.
The latest developments have renewed attention on the need for stronger security infrastructure, improved monitoring of suspicious blockchain transactions and greater accountability among cryptocurrency service providers.
With investigations continuing and billions of dollars in stolen assets still being traced, the Binance breach represents a significant test of the cryptocurrency industry’s ability to respond to increasingly sophisticated cyberattacks.
