The world’s largest cryptocurrency exchange has been hit by a record $6.3bn (£4.7bn) hack described as the biggest heist in history, with experts identifying North Korea as the likely culprit.
Binance said it would cover all customer losses as it froze $3bn of the affected assets.
Analysts said the exchange had been subjected to an unprecedented attack with “never-seen-before” laundering patterns as the hackers made off with assets worth billions of dollars.
Researchers said the theft was the biggest ever, dwarfing a $1.5bn crypto raid last year and the $1bn taken from Iraq’s central bank by Saddam Hussein in 2003. “This is almost certainly the largest theft of any kind in history,” said Tom Robinson, chief scientist at crypto consultancy Elliptic.
Experts attributed the attack, which happened late on Thursday, to North Korean state-backed hackers. North Korea has a history of crypto hacking and was behind the theft of about $1.5bn in virtual assets from a Dubai-based cryptocurrency exchange last year, according to the FBI, in the previous record crypto heist.
TRM, a crypto analysis firm, blamed the attack with “high confidence” on TraderTraitor, North Korea’s elite hacking unit, as did Elliptic and another research outfit, Chainalysis.
An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance’s engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said. The company added later that there had been “additional points of breach” in a sophisticated attack.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8bn in assets under custody as of the exchange’s 2025 annual report.
Richard Teng, a co-chief executive of Binance, said: “Bottom line – your money is safe, and we’re covering every loss.” Teng said Binance had set aside $6.34bn to cover stolen assets.
The company was founded by the Chinese-born entrepreneur Changpeng Zhao, now a Canadian and United Arab Emirates citizen, who was jailed for four months in 2024 after pleading guilty to money laundering violations. Donald Trump pardoned him in 2025.
The company said: “As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure and trace affected assets, with the close support of our law enforcement and industry partners.”
Markets reacted immediately in early Asian trading on Friday, and within hours bitcoin – the most popular crypto asset by far – had fallen 5% from its level before news of the hack broke, to $77,380, its lowest level in six weeks.
Zhao posted to X on Thursday: “User funds are safe!” but added that the incident “does look like a hack”. He added that while he did not manage Binance any more, “as a shareholder, I expect all user funds will be fully covered”.
In a post on X, Binance reiterated that it was working “to trace, freeze and recover additional funds”, and signed off: “We will weather this storm. Thank you for the support.”
Beyond the potential loss of assets, the security breach was likely to have wider ramifications for crypto, which had already been under pressure because of higher US interest rates and softer demand from exchange-traded fund buyers, analysts said.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” said Tim Sun, a senior researcher at HashKey Group, based in Hong Kong.
North Korea, a state hampered by sanctions and starved for cash, has become a prolific hacker of crypto, an asset it favours because it can be stolen in bulk and laundered. The regime has stolen more than $6.5bn in crypto assets in recent years, including more than $1bn so far in 2026, according to Elliptic.
Binance is working on the aftermath of the hack with law enforcement around the world, including the FBI and the US Secret Service.
Tether, an issuer of stablecoins, which trade at a value fixed to a conventional currency like the US dollar, said it had frozen nearly $1.57bn in assets linked to the incident, while Circle froze more than $800m.The largest losses related to the Ethereum cryptocurrency, with $3.8bn-worth affected, according to Elliptic.
World Liberty Financial, a crypto company linked to Trump and his family, said on Thursday it had worked with the cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack.
The incident adds to a string of crypto thefts. Last year attackers stole $2.9bn worth of cryptocurrency across almost 150 attacks, according to TRM. In September the cryptocurrency exchange Bitget said roughly $350m in crypto had been stolen from its platform, underscoring the industry’s vulnerability to hackers.
Authorities have warned that organised crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system.
Binance.US, a separate cryptocurrency exchange, said it was not affected by the security incident.
The UK’s financial watchdogs are monitoring the hack for any potential fallout. While crypto companies are not regulated in the UK, the Bank of England and the Financial Conduct Authority (FCA) will be keeping an eye on any banks, insurers or fintechs that are exposed to Binance, and how that could hurt the UK’s wider financial system.
A spokesperson for the FCA said: “While Binance wasn’t registered with the FCA to provide crypto services in the UK, we’re aware of the reported incident and engaging with them to understand the impact.”
The Bank of England is also monitoring the hack, according to a source familiar with the matter. However, it is understood there are no active concerns. The Bank declined to comment.
Coinbase, another major cryptocurrency exchange, said it was unaffected and was monitoring the situation.
In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider. It later resumed trading and said it would fully reimburse affected traders.
Reuters and the Associated Press contributed to this report
