Binance, the world’s largest cryptocurrency exchange, has confirmed that approximately $6.3 billion in digital assets were stolen in a security breach that blockchain intelligence firms have attributed with “high confidence” to a North Korean state-sponsored hacking unit, in what analysts are calling the largest crypto heist ever recorded.
The exchange said on Thursday that it had suspended all deposits and withdrawals and that roughly $3 billion in affected assets had been frozen through coordination with blockchain partners and stablecoin issuers . Binance co-founder Yi He said the company would cover all losses and that user funds remained safe .
How the Attack Unfolded
According to a detailed analysis by TRM Labs, the attacker targeted Binance wallets across at least ten blockchains, moving the bulk of the funds within approximately 20 minutes . The stolen assets included 18,270 Bitcoin (approximately $1.47 billion), 612.7 million USDT and 46.4 million TRX on the Tron network, 233.46 million XRP, and significant holdings on Ethereum, Solana, and several Layer 2 networks .
Binance’s preliminary investigation suggested the breach originated from a compromised laptop belonging to a DevOps engineer, which allowed the attacker to access a service container and initiate unauthorized withdrawal transactions. The exchange said it found no evidence of private key leakage .
TRM Labs said preparation for the attack began at least 36 hours in advance, with the attacker’s operator wallet receiving small withdrawals from Tornado Cash, a crypto mixing service, starting on October 28. The attacker tested the exploit code on multiple wallets before deploying it against Binance’s hot wallets .
North Korean Attribution
TRM Labs assessed with “high confidence” that the attack was carried out by TraderTraitor, a North Korean hacking unit associated with the Lazarus Group . “We base this assessment on robust on and off-chain intelligence sources,” the firm said .
The attribution follows a pattern of escalating North Korean crypto theft. According to Chainalysis data, DPRK-affiliated actors stole approximately $2.02 billion in 2025, a 51 percent increase from the previous year, bringing cumulative loot since 2017 to roughly $6.75 billion . In the first four months of 2026 alone, North Korean hackers were responsible for 76 percent of global damage from crypto hacks .
Authorities say such operations serve as a key revenue source for North Korea’s nuclear and missile programs, circumventing international financial sanctions .
Market Fallout
The disclosure sent shockwaves through crypto markets. Bitcoin fell to a six-week low, dropping approximately 3 percent to around $76,470, while Ether declined more than 3 percent to $2,186 . Shares in Coinbase Global slid 4.8 percent, and bitcoin buyer Strategy fell nearly 6 percent in extended US trading .
Aravind Srinivasan, head of systematic OTC business at crypto market maker GSR, described the scale of the breach. “It’s the biggest hack in history… spreads are wider and liquidity is thin in Binance too on spot. The average bid/ask spread on spot bitcoin was five times wider than normal earlier this morning, and 2.5 times for ether” .
Sean Foley, an expert in crypto markets at Macquarie University in Sydney, told Al Jazeera that the attack highlighted the risks of centralized exchanges. “Any assets held at a centralized exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes” .
Background: A Pattern of Escalation
The Binance breach dwarfs the previous record holder: the February 2025 theft of approximately $1.5 billion in Ethereum from Bybit, which was also attributed to TraderTraitor . Other major incidents include the Ronin Network breach in March 2022 (approximately 320 million), and the Poly Network hack in August 2021 ($610 million, later largely returned) .
Changpeng Zhao, Binance’s founder and largest shareholder who stepped down as CEO in 2023, said in a post on X that while he no longer manages the exchange, “as a shareholder, I expect all user funds will be fully covered” .
Binance, founded in China by Zhao in 2017, has approximately $155 billion in assets under management, more than any other exchange, according to CoinMarketCap. The exchange said it would share a detailed technical post-mortem once investigations were complete and that it was working with law enforcement partners to identify the perpetrators .
For Ghanaian and African crypto users, the breach underscores the counterparty risks inherent in holding assets on centralized platforms. Analysts have warned that the incident could accelerate a migration toward decentralized exchanges, even as it reignites questions about the security of digital assets held on custodial platforms globally.
