Cryptocurrency giant Binance said $6.3bn (£4.7bn) worth of digital assets were affected in a hack that could be the largest of its kind in history. The news shocked the market, and the price of Bitcoin fell to a nearly one-month low.
The world's largest cryptocurrency exchange said about half of the affected assets have been frozen, but many are still in the hands of hackers. The company promised to use its own funds to "bear all losses" and said it would resume withdrawal services in 45 hours.
Preliminary investigations indicate that the incident may have started with a compromised engineer's laptop. Two analysis firms pointed the finger at a North Korean hacker group called "Trader Traitor," but the link has not been confirmed.
The identity of the attacker has not yet been determined, and the speed with which he committed the crime has alarmed cybersecurity experts. How did this attack happen, who might be behind it, and what kind of company is Binance? Here's what's known so far.
‘The largest ever’ attack: Binance promises to bear all losses
Binance said that preliminary checks showed that the incident may have involved a compromised engineer’s laptop, which the attacker used to make unauthorized withdrawals.
The exchange later reported that although the initial investigation pointed to a "compromised laptop", further digging "found more intrusion points." Binance did not disclose further details about the intrusion and said it would continue to announce the progress of the investigation.
The statement said: "Binance will use the SAFU fund (User Asset Security Fund) and company funds to bear all losses. User funds are safe. We are still progressing as expected and will resume withdrawal services in 45 hours. Deposits will not be affected." The statement added that the exchange is working with partners to freeze affected assets, "approximately US$3 billion has been frozen so far."
Binance co-CEO Richard Teng later issued a full statement:
"I want to speak directly to everyone about what happened. At the end of the day, your funds are safe and we will absorb all losses."
"Preliminary investigation indicates that this security incident may have started with a compromised DevOps engineer's laptop. This allowed the attacker to gain access to a service container and submit unauthorized withdrawal transactions there."
"It needs to be clear that the attacker did not simply exploit the authority of an engineer, nor was this a single 'one-click' operation, but involved a more complex attack process. Our investigation did not attribute responsibility to any individual. So far, we have not found any evidence that the wallet private key has been leaked."
"After the investigation is completed and all facts are verified, we will publish a detailed technical review report and publish the latest Proof of Reserves after the repair work is completed."
The market immediately took a hit. According to multiple reports, the price of Bitcoin fell by about 5% to about $76,400 (£56,900). Agence France-Presse (AFP) said this was its lowest level in nearly a month. Bloomberg reported that tokens such as Ether, Solana and Ripple (XRP) also fell.
Attack method: Transfer billions "in minutes"
It is considered the largest cryptocurrency hack on record, but Jayant Dave, an expert at cybersecurity firm Check Point, said what makes it notable is the way it was carried out.
"The attackers did not break the encryption, and they did not steal the private keys. They took control of the system that dictated what the keys signed." He said Binance's preliminary findings pointed to a compromised engineer's laptop that the attackers used to gain access to a service that could submit withdrawals and transfer billions of funds "in minutes."
"Here's the lesson: No matter how strong a vault is, it doesn't matter if someone controls the process of opening it," Dave said. He warned that it’s not just cryptocurrency companies that face this risk. Banks or other institutions with automated systems that move funds or data on command also face this risk.
Emily Taylor, co-founder of Global Signal Exchange, an organization that helps prevent scams and other forms of cybercrime, told BBC Radio 4's Today program that the financial losses set a "bleak new record" and that the attacks were carried out "at a speed and scale we have never seen before."
"It also very much highlights our dependence on technology," she added. "The way we handle money today is different than it was 10, 20, 30 years ago."
Taylor said a common method used by hackers to break into systems is to lure engineers in high-level positions with false job advertisements and then convince them to download a test or other software to hack into their computers.
“So, imagine that in a company like Binance, an engineer with a heavy responsibility would have very broad permissions to withdraw money throughout the system and so on, because they are responsible for maintaining the security of the system.”
North Korean hacker suspicions: connection not yet confirmed
The identity of the hacker is not yet known.
However, two analysis companies have attributed the incident to "TraderTraitor". Artificial intelligence investigation company TRM Labs said in a report that many elements of the Binance attack are similar to earlier incidents related to North Korea, including the record-breaking $1.5 billion hack of Bybit exchange in 2025. Chainalysis, another encryption analysis company, also said it had a "high degree of confidence" that the North Korean organization was involved in the hacking attack.
Binance said it was "working closely" with law enforcement agencies to identify them and "bring them to justice", but did not directly respond to the BBC's inquiry about possible links to North Korea.
Over the past five years, the crypto industry has been plagued by huge losses caused by hackers, with more destructive attacks occurring almost every year, with cryptocurrency exchanges often being targeted. In nearly all cases, investigators point to North Korean hackers, particularly the notorious Lazarus Group, known to the U.S. government as "Trader Traitor." The names refer to cybercriminal gangs accused of working directly for the regime.
North Korea is a poor country with almost no industry and is subject to severe international sanctions. Experts say the regime uses cybercrime as a means of obtaining funds. North Korea has always denied this, but the overwhelming evidence from analysis of cryptocurrency flows and interviews with North Korean defectors is compelling, making it likely that North Korea is the only country to use hacking as a means of raising public funds.
In the 2025 incident, hackers believed to be working for North Korea stole $1.5bn (£1.1bn) and managed to convert at least $300m into irrecoverable funds within about two weeks of the attack.
In August this year, 18 months after the attack, Bybit co-founder Ben Zhou posted on the He added that the exchange has also filed civil lawsuits against North Korea and the Lazarus Group.
