Binance freezes half of $6.3bn stolen in record cryptocurrency hack

Binance, the world’s largest cryptocurrency exchange, has stated that it has secured approximately half of the digital assets stolen in what is believed to be the largest heist in the history of the industry. The firm confirmed that $6.3bn, equivalent to £4.7bn, was accessed during the incident, with $3bn of those stolen assets subsequently frozen. While the company has managed to secure a significant portion of the funds, a substantial amount remains in the possession of unidentified hackers. Initial reports suggested that the breach originated from a compromised engineer’s laptop, but subsequent investigations have indicated that the attack was more widespread and complex than first thought.

Several cryptocurrency analytics firms have linked the incident to a North Korean hacking unit. This assessment is supported by the US Secret Service, which stated it is working continuously to identify, trace, and recover the stolen funds. The agency emphasised its commitment to identifying the cyber criminals responsible and bringing them to justice. Binance has confirmed it is cooperating with the Federal Bureau of Investigation in these efforts. Although the exchange’s US-facing platform was reported to be unaffected, US authorities maintain jurisdiction to investigate the hack and assist in tracking the stolen assets, a process that typically requires a coordinated global law enforcement response. The hack also involved US-linked assets, including stablecoins Tether and Circle, which are cryptocurrencies pegged to the US dollar.

Richard Teng, co-CEO of Binance, addressed the nature of the attack, clarifying that it was not carried out by a single individual. He noted that while the initial investigation pointed to a compromised laptop, further scrutiny uncovered additional points of breach. Teng described how the hackers employed a self-destruct mechanism that destroyed tools and traces as they progressed, significantly complicating the tracing and investigation process. In response to the incident, Binance suspended all deposits and withdrawals before later updating users to confirm that deposits remained unaffected. The company assured its customer base that their money is safe and that it is covering every loss. To support this commitment, Binance stated it has set aside more than $6.34bn in company funds and is actively purchasing a range of crypto tokens to cover the stolen assets.

The incident caused immediate volatility in cryptocurrency markets on Friday. Bitcoin prices fell by 5 per cent to $76,800 during afternoon trading in New York. Shares in Coinbase, a major cryptocurrency exchange, dropped by 12 per cent, a decline attributed partly to investor reaction to earnings results that showed revenue slightly below expectations. Robinhood, a financial services company that facilitates cryptocurrency trading, saw its shares fall by 7.8 per cent. The market reaction has heightened concerns among users and industry observers regarding Binance’s financial capacity to absorb such a massive loss. While the company has repeatedly asserted that customer funds are protected and that it is strong enough to withstand the impact, some analysts have drawn comparisons to the collapse of FTX in 2022, where similar assurances preceded significant customer losses.

Legal experts have cautioned customers not to assume that Binance’s promise to cover losses is legally binding. Daniel Tunkel of the London-based law firm Edwin Coe suggested that recovery may depend on the specific terms of customer contracts and could potentially require litigation for non-performance. Binance, which was founded in China in 2017 and is estimated to have over 300 million registered users worldwide, reported in 2024 that it held more than $160bn in assets under its custody. The company has faced regulatory scrutiny globally in recent years. TRM Labs, an AI-powered investigations company, noted that several elements of the attack resemble earlier North Korean-linked incidents, including the 2025 hack on the Bybit exchange, which resulted in $1.5bn in losses. Chainalysis, another crypto analytics firm, expressed high confidence that a North Korean actor is linked to the current hack. Experts indicate that the North Korean regime, which faces heavy international sanctions and limited industrial capacity, uses cyber crime as a primary method for generating public funds, a claim the country has consistently denied.