Binance hack exposes $6.3bn in what could be the biggest crypto theft ever

Binance attack could be biggest crypto theft on record

The scale of the breach has drawn comparisons with previous attacks on major exchanges, with blockchain investigators identifying TraderTraitor as the likely culprit. 

The group, which Western security agencies have linked to North Korea, has previously been accused of stealing $1.5bn from Bybit in 2025.

Its alleged involvement is particularly concerning because stolen digital assets are believed to provide a source of funding for North Korea's nuclear and missile development programmes. 

Pyongyang has repeatedly denied responsibility for similar cyberattacks.

Binance freezes half of stolen funds as investigation continues

Binance confirmed the incident on Thursday, describing how criminals gained access to customer assets and made withdrawals without permission. 

Initial investigations suggest an engineer's laptop had been compromised, giving the attackers a route into the system.

The exchange has pledged to absorb the financial damage and reimburse affected customers in full. 

It is also working with law enforcement agencies to establish who was behind the operation and track down the missing money.

There has been some progress in recovering the funds, with investigators freezing around half of the $6.3bn involved. 

However, the remaining assets are still believed to be beyond their reach, making the recovery operation a considerable challenge.

Investigators warn Binance hack probe is far from over

Two cryptocurrency analysis companies, TRM Labs and Chainalysis, have separately attributed the attack to TraderTraitor. 

Chainalysis said it had “high confidence” in its assessment, while TRM Labs described the incident as a major turning point for the sector.

Ari Redbord, who heads policy at TRM Labs, told the BBC the breach was “a watershed moment” unlike anything the cryptocurrency industry had previously experienced. 

He warned that the substantial amount still held by the attackers meant the investigation was nowhere near over.

The incident also raises fresh questions about the security of an exchange used by millions of cryptocurrency traders worldwide. 

A theft on this scale could further undermine confidence in digital asset platforms at a time when the industry is already facing increased regulatory scrutiny.

Binance has stressed that the compromised service was its international platform, Binance.com, and not Binance.US, which operates separately for American customers.

The company has not confirmed the claims about North Korean involvement. In a statement to the BBC, it said it was “working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”