Binance, the world’s largest cryptocurrency exchange, said Friday that hackers stole more than $6 billion in digital assets in what appears to be the biggest cryptocurrency theft on record. The company said it has set aside $6.34 billion of its own funds to cover the stolen assets and has begun efforts to recover money for users.
The incident involved Binance wallets on 10 blockchains, according to TRM, a U.S.-based blockchain intelligence company. TRM said an attacker transferred about $6.36 billion, with most of the movement occurring in roughly 20 minutes. Blockchain-analysis firm Chainalysis also assessed that the attack was likely connected to TraderTraitor, a hacking group that the companies associate with North Korea.
What happened
Binance said its initial review indicated that a compromised laptop may have played a role. A later investigation found additional “points of breach,” the company said. Binance has been working with other blockchain firms to identify and freeze assets connected to the theft. Those efforts have immobilized about $3 billion in affected funds, according to the exchange.
“We are working nonstop to resolve this,” Binance co-CEO Richard Teng said Friday in a video posted to X.
Binance has promised to reimburse users for their losses and has been posting updates as its investigation continues. The exchange’s actions are intended to separate the company’s responsibility from the assets held by customers: Binance said the reserve would be used to cover stolen holdings rather than leaving users to absorb the loss.
Why North Korea is being examined
TRM attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit. The firm said it made that assessment with “high confidence” and identified several characteristics that matched earlier thefts linked to North Korea. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that the Binance hack was likely carried out by TraderTraitor.
Those assessments remain part of an investigation rather than a final public attribution by U.S. authorities. During an exchange with reporters at the White House on Friday, President Donald Trump said U.S. officials were investigating the attack. When asked whether North Korea was involved, Trump said, “We’re looking at that.” A Binance spokesperson said the company was working with law-enforcement partners to confirm the criminals’ identities.
What the figures show
- More than $6 billion: the amount Binance said was stolen.
- $6.34 billion: the company’s reserve for covering the stolen assets.
- About $3 billion: the amount blockchain partners helped freeze.
- 10 blockchains: the number of networks involved in the transfers identified by TRM.
The case illustrates how a large cryptocurrency theft can spread across multiple blockchain networks while investigators and exchanges try to track and restrict the movement of funds. Binance’s recovery effort, the blockchain firms’ attribution and the U.S. investigation are proceeding at the same time, with the company continuing to report developments through its social-media channels.
