$6.3 billion was the target. How did the attack on crypto giant Binance begin, what precautions were taken?

Binance, the world's largest cryptocurrency exchange, announced yesterday that digital assets worth $6.3 billion (314 billion 667 million Turkish Liras) were exposed to a cyber attack that can be considered the largest in history.

The company announced that about half of these assets were frozen, while many were still in the hands of pirates, but that it would "cover all losses."

Initial investigations from Binance indicate that attackers may have made unauthorized withdrawals via an engineer's compromised laptop.

Many industry observers had expressed concerns about a possible attack on Binance hours before the exchange confirmed the security issue.

Following the warnings, Bitcoin lost more than 4 percent in value, while the prices of other major cryptocurrencies, including Ethereum and Solana, fell sharply.

While the incident only involved the Binance.com platform, the much smaller crypto platform Binance.US, which provides trading services directly to US residents, said it was not affected by this issue.

Binance Holdings Ltd., seen in Dubai, United Arab Emirates, in May 2023. Co-founder and Co-CEO Yi He thanked various cryptocurrency issuers for freezing assets in consecutive posts.

"Security first: Withdrawals are disabled until the environment is confirmed to be safe," Yi He said, according to the Financial Times newspaper.

Two analysis companies attributed this incident, which surpassed the record $1.5 billion attack on the Bybit exchange in 2025, to a North Korean cyber hacker unit called TraderTraitor.

In its report, artificial intelligence-supported research company TRM Labs revealed that the Binance attack is similar to previous North Korea-related incidents, including the Bybit attack, in many aspects.

Speaking to the BBC, Ari Redbord, Head of Global Policy at TRM Labs, said the Binance attack was a "turning point" unlike anything the industry has ever seen.

Redbord added that the attacker still holds a massive amount of stolen assets, so efforts to track down and recover the funds are far from over.

Another crypto analysis company, Chainalysis, also announced that it was “highly confident” that the North Korean group was linked to the attack.

Eric Jardine, Head of Research at Chainalysis, called on all exchanges to be vigilant, as they are an attractive target for cyber hackers due to the enormous value of the assets they hold.

North Korea-linked elements have been focusing on attacking cryptocurrency companies for large-scale digital token thefts over the past few years.

Western security agencies have previously announced that the stolen funds were used to finance North Korea's nuclear weapons and missile development programs, while the regime has denied any connection with past attacks.