Binance says $6.3bn in assets affected by record crypto hack
Binance said about $6.3bn of digital assets were affected by an attack analysts call the largest crypto theft on record, that roughly half had been frozen, and that it would cover all losses. Two analytics firms attributed the hack to a North Korean unit known as TraderTraitor.
(See the reader poll and source context below).
What do the sources establish?
| Platform / Source | Core Stance / Quote | Engagement Metric | Timestamp |
|---|---|---|---|
| BBC News | Reported context: the $6.3bn figure and the frozen share Binance saying it will cover all losses the compromised engineer's laptop and additional breach points TraderTraitor and Lazarus attribution by analytics firms Binance declining to confirm a North Korean link | Not recorded | |
| The Guardian | Reported context: about $3bn located so far and the remaining $3.3bn the 335 million registered users and $162.8bn custody figure bitcoin falling to $76,368 and the Coinbase and Strategy moves the Teng and Zhao quotes the suspended deposits and withdrawals | Not recorded | |
| CNBC | Reported context: the freeze by Circle and Tether the containment effort and exchange statements | Not recorded | |
| CNBC | Reported context: the $800m Circle freeze and $1.56bn Tether freeze the Binance frozen total of $3bn the Teng statement and the market reaction | Not recorded |
Binance said on Thursday that about $6.3bn (£4.7bn) of digital assets had been affected by what analysts describe as the largest crypto theft on record, and that it would cover all losses. About half of the assets have been frozen, the exchange said, while a large sum remains with the attackers.
The company said its first checks pointed to a compromised engineer's laptop, which gave an intruder access to a service container and the ability to submit unauthorised withdrawals. Its follow-up investigation then found "additional points of breach". Richard Teng, one of Binance's co-chief executives, said the attacker did not simply use one engineer's permissions and that the incident "was not a single 'one-click' action". Binance has suspended deposits and withdrawals as a precaution. The exchange has not published a breakdown of which assets were affected, and it has not said how long the suspension will last.
What Binance has confirmed, and what it has not
The confirmed numbers are the size of the affected holdings and the freeze. Binance says roughly half of the $6.3bn was frozen, and the Guardian reports that about $3bn had been located by Friday morning. The exchange gave no update on the remaining $3.3bn.
What Binance has not done is confirm that the funds were stolen in the way the analytics firms describe. The company declined to answer BBC questions about a possible North Korean link, saying only that it was "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice". Its public statements have focused on the freeze and on making customers whole.
The attribution: TraderTraitor, and why it matters
Two analytics firms attributed the attack to a North Korean unit known as TraderTraitor. Chainalysis said it had "high confidence" in the link, and TRM Labs said several elements resembled earlier North Korean-linked incidents. Check Point, a security firm, said the unit is also known as Lazarus Group and was blamed for the 2025 Bybit hack, which cost about $1.5bn and was the previous record.
TRM's global head of policy, Ari Redbord, told the BBC the Binance incident is a "watershed moment" unlike anything the industry has seen. Chainalysis research head Eric Jardine said exchanges remain attractive targets because of the value they hold and urged them to stay vigilant. Western agencies have said stolen crypto has funded North Korean weapons programmes; Pyongyang has denied involvement in past hacks.
What it cost holders and the wider market
Markets moved within hours. Bitcoin fell more than 3% to a six-week low of $76,368 in early Asian trading on Friday, the Guardian reported. Coinbase shares slid 4.8% and shares in the bitcoin buyer Strategy fell nearly 6% in extended US trading.
The exchange's own numbers put the scale in context. Binance says it has 335 million registered users globally and held about $162.8bn in assets under custody at the end of its 2025 financial year. The freeze also pulled in other players: CNBC reported that Circle froze $800m and Tether froze $1.56bn connected to the incident.
The company's response, in its own words
Teng's message to users was blunt: "Bottom line – your money is safe, and we're covering every loss." Binance co-founder Yi He said the company would cover "all hacking losses". Changpeng Zhao, who founded Binance in 2017 and stepped down as chief executive in 2023 after pleading guilty to a US money-laundering charge, posted that "User funds are safe" and that the incident "does look like a hack on Binance". He added that as a shareholder he expected full coverage.
The operational side is slower. Deposits and withdrawals remained suspended on Friday morning, and Binance said it would restore them once its checks are complete. Binance said all deposits and withdrawals are suspended while teams check systems, secure wallet infrastructure and trace assets. Its US affiliate, Binance.US, said it was not affected.
What to watch next
Three things will decide how this reads in a month. The first is how much of the $3.3bn still unaccounted for is recovered, and whether the freezes hold up. The second is the forensic detail: Binance's account of a laptop and a service container is the start of an explanation, not the end of one, and the analytics firms have not published the evidence behind their attribution.
The third is regulatory. The incident lands on an exchange that has spent years under scrutiny in several jurisdictions, and it will be used in arguments about custody, wallet architecture and how quickly large holders can be frozen out of stolen funds. For readers following the policy side, our coverage of the Fed's stablecoin issuer rules and the Ledger hardware implant case sets out the rules and the hardware questions that surround custody. The Fed's enforcement action against Amex is a useful comparison for how US regulators handle compliance failures.
For now the facts that hold are narrow. Binance says $6.3bn was affected, roughly half is frozen, and it will cover losses. Two analytics firms say North Korea is responsible. The rest, including the size of any unrecovered loss to the company rather than to users, is still being worked out.