Binance, the world’s largest cryptocurrency trading platform, has been hit by a massive cyberattack that affected digital assets worth $6.3 billion. The incident is being considered the largest theft ever recorded in the history of cryptocurrencies.
The company said that about half of the affected assets have been frozen, while the rest are believed to remain in the hands of hackers. Binance has stated that it will cover all losses and is cooperating with authorities to identify those responsible.
According to initial investigations, the attack may have started from the compromise of a company engineer’s laptop. Through it, the attackers are believed to have gained access to one of the internal systems and carried out unauthorized withdrawals.
Two companies specializing in analyzing cryptocurrency transactions, TRM Labs and Chainalysis, have attributed the attack to a North Korean hacking unit known as TraderTraitor. According to the cybersecurity firm Check Point, this group is also known as the Lazarus Group, which has also been accused of other major attacks on the cryptocurrency industry.
Jayant Dave, a senior information security official at Check Point, said the value of the losses makes this the largest attack of its kind recorded so far. Ari Redbord, head of global policy at TRM Labs, also described the event as a turning point for the industry, warning that a significant amount of the stolen assets remains beyond the control of authorities.
Involvement of the Lazarus Group is suspected
North Korea has for years been accused by Western authorities and cybersecurity companies of using specialized hacking groups to steal cryptocurrencies. According to security agencies in the United States and South Korea, funds obtained from these attacks are believed to be used to finance North Korea’s nuclear programs and missile development.
For its part, Binance said it is working closely with law enforcement partners to confirm the identity of those responsible and bring them to justice.
Binance Co-CEO Richard Teng said initial investigations indicate the attack may have started from a compromised engineer’s computer. He clarified that the hackers gained access to a service system, through which they sent unauthorized transactions to withdraw the assets. Teng stressed that the attack was more complex than a simple intrusion through an employee’s credentials, and that so far there is no evidence that private keys of digital wallets have been exposed.
The company also announced that fund withdrawals have been temporarily suspended until it is confirmed that the systems are fully secure. Binance warned that it will publish a detailed report on the attack once the investigations are complete.
Meanwhile, the platforms Tether and Circle have said they have jointly frozen about $2.4 billion in assets believed to be linked to the attack. World Liberty Financial, a company linked to U.S. President Donald Trump and his family, also said it has cooperated with partners to block the stolen funds.
News of the attack triggered immediate reactions in cryptocurrency markets. Bitcoin fell by more than 4 percent after the first reports of the incident. Ethereum and Solana also recorded significant declines, while investors expressed concern about the security of assets held on centralized platforms. Coinbase said its platform has not been affected by the incident and that it is monitoring the situation.
Meanwhile, Binance.US, a smaller platform that offers trading services specifically for American users, confirmed that it has not been affected by the attack. Binance, founded in 2017 in China, has more than 300 million registered users worldwide and, according to data published by the company, manages over $160 billion in client assets. The latest attack also surpasses the $1.5 billion theft that hit the Bybit platform in 2025, once again raising questions about the security of the global cryptocurrency industry.