Binance hack updates: US Secret Service says it is helping to track funds stolen from crypto firm in $6.3bn hack - BBC
Cryptocurrency giant Binance has revealed a $6.3bn hack, potentially the largest in history, with about half of the assets frozen and the company promising to cover all losses.
Cryptocurrency giant Binance has confirmed a security breach affecting $6.3bn (£4.7bn) in digital assets, potentially marking the largest hack in history. The world's biggest crypto exchange reported that approximately half of the compromised assets have been frozen, with the remainder still in the hands of the hackers. Binance has pledged to cover all losses from the incident using its SAFU fund and company funds.
The hack eclipses the previous record-setting $1.5bn attack on the Bybit exchange in 2025, which was also attributed to North Korean hackers. In that incident, the Lazarus Group, also known as TraderTraitor, successfully converted at least $300m into unrecoverable funds within two weeks. Bybit later recovered about $48.4m and had another $30.5m frozen.
Attack Origin
According to Binance's initial investigation, the security incident may have originated from a compromised DevOps engineer's laptop. This gave the attacker access to a service container where they submitted unauthorized withdrawal transactions. Binance co-CEO Richard Teng emphasized that the attack involved a more complex process rather than a single 'one-click' action.
To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process.
North Korean Connection
Two analytics firms have linked the Binance hack to a North Korean hacking unit called TraderTraitor. TRM Labs reported that several elements of the attack resemble previous North Korean-linked incidents, including the Bybit hack. Chainalysis also expressed 'high confidence' in the connection between the North Korean group and the hack.
North Korea has been increasingly associated with major crypto hacks in recent years. The impoverished nation under heavy international sanctions allegedly uses cybercrime as a means to generate revenue. The Lazarus Group, believed to work directly for the regime, has been blamed for numerous high-profile attacks.
Industry Response
Following the breach, Binance temporarily suspended withdrawals while conducting a security revamp of its withdrawal service. The exchange has revoked affected address authorizations and engaged law enforcement and blockchain intelligence partners to trace and recover funds. Other major platforms, including Tether and Circle, have frozen approximately $2.4bn of assets in response.
Cyber security expert Emily Taylor described the hack as setting a 'grim new record' conducted 'on a speed and scale we've never seen.' She highlighted how such incidents underscore society's growing dependence on technology and the evolving nature of financial systems.
The hack has already impacted markets, with Bitcoin dropping more than 4% following the security alerts. Binance.US, which provides services specifically for American residents, confirmed its platform is not affected by the incident. The exchange has faced regulatory scrutiny globally, including a 2023 settlement where former CEO Changpeng Zhao pleaded guilty to money laundering violations.
Related
