'Biggest hack in history' as North Koreans blamed for huge Bitcoin heist that put crypto market in chaos - The Independent

The heist marks the largest theft in the history of cryptocurrency, according to analysts at TRM Labs and Chainalysis. The attackers targeted Binance wallets across 10 different blockchains, siphoning the majority of the funds within just 20 minutes.

TRM Labs has linked the operation to North Korea, a conclusion it reached with high confidence. The firm noted that the attack mirrors a 2025 hack on the exchange Bybit, which was also attributed to the same group by the FBI.

Binance co-founder Yi He confirmed that the exchange had located and frozen approximately $3 billion of the stolen assets. She stated that the remaining $3.3 billion was still being traced and that the exchange would cover all hacking losses.

Market reaction

The news sent shockwaves through the global crypto market, with Bitcoin dropping more than 3% to a six-week low of $76,368. Ether fell by a similar margin to a two-month low of $2,178, while Binance Coin (BNB) declined by 5% to $709.70.

Shares in Coinbase Global slid 4.8% in extended US trading, while those of Strategy fell nearly 6%. The broader sell-off reflects investor anxiety about the security of digital assets and the potential for further losses.

Aravind Srinivasan, head of large crypto market maker GSR's systematic OTC business, described the incident as the biggest hack in history. He noted that markets reacted immediately in Asian trading on Friday as the scale of the breach became clear.

Security breach details

Binance said an initial investigation suggested the breach began with a hacked laptop belonging to one of its engineers. This gave the attackers access to a system, allowing them to make unauthorized withdrawals.

The exchange stated that the incident stems from multiple factors and that its security team is tracing the full attack path through the compromised computer. This entry point is believed to be the starting point of the incident.

Binance runs a secure asset fund for users, which is a reserve held entirely in bitcoin intended to protect user assets in cases of security breaches. The company emphasized that user funds remain safe.

Industry response

Stablecoin issuers Tether and Circle said they had frozen nearly $1.57 billion and more than $800 million in assets linked to the incident, respectively. World Liberty Financial, a crypto company linked to US President Donald Trump and his family, also froze funds with the help of custodian BitGo.

Ripple froze roughly $200 million in funds and said it was closely monitoring reports of the potential exploit. Jack McDonald, senior vice president of stablecoins at Ripple, confirmed the company was freezing affected funds and coordinating with relevant parties.

Bernardo Brites, CEO of Trace Finance, argued that it is becoming very hard to counter hacks as AI can find vulnerabilities faster than they can be fixed. He predicted that users will move away from smaller and medium-sized exchanges due to the increased risk.

Broader implications

The incident adds to a string of crypto thefts, with attackers stealing $2.9 billion worth of cryptocurrency across nearly 150 attacks last year. In September, Bitget reported the theft of roughly $350 million from its platform.

Tim Sun, a senior researcher at HashKey Group, warned that the breach may further dampen risk appetite. He suggested it would prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks.

Authorities have warned that organized crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system. The Binance hack underscores the growing sophistication of these groups and the persistent vulnerabilities in the crypto ecosystem.

Next steps

Binance said deposits were unaffected and expects withdrawals to resume within 48 hours. The company is working with partners to trace the remaining stolen funds and has pledged to cover all losses incurred by the hack.

Binance.US and Coinbase stated that they were not affected by the security incident and were monitoring the situation. The broader crypto industry will be watching closely to see how the exchange handles the aftermath and whether it can restore investor confidence.