Binance, the global cryptocurrency giant, announced on Thursday that its digital assets worth $6.3 billion were damaged due to what is believed to be the largest hack of a cryptocurrency platform in history.
The world's largest cryptocurrency exchange confirmed that about half of those targeted assets had been frozen, but many were still in the hands of the hackers, adding that it would "cover all losses."
The company said initial tests revealed that an engineer's laptop had been compromised, allowing the attacker to make unauthorized withdrawals, and subsequent investigations revealed "additional points of compromise."
Two companies specializing in analytics and cybersecurity have accused a North Korean hacking unit of involvement in the incident, which is larger than a previous $1.5 billion hack targeting the Bybit platform in 2025.
Cybersecurity company Check Point explained that the unit is also known in this field as the “Lazarus Group,” which was blamed for the hack that occurred in 2025.
Jayant Dev, chief information security officer at Check Point, said Binance's estimated losses made it "the largest cryptocurrency theft ever."
For its part, the artificial intelligence-supported investigations company TRMLab noted in its report that many elements of the Binance attack are similar to previous incidents linked to North Korea, including the PayBit hack.
Ari Redbord, the lab's global head of policy, told the BBC that the Binance hack represents an unprecedented "watershed moment" in the industry's history.
Redbord added that the attacker still holds a huge amount of stolen assets, which means efforts to trace and recover the funds are far from over.
Binance, which was founded in China in 2017, allows users to trade digital assets, and is estimated to have more than 300 million registered users around the world.
The company said in 2024 that it had more than $160 billion in assets under its custody.
The exchange has been subject to regulatory scrutiny around the world.
Chain Analysis, also a cryptocurrency analysis firm, said it had "high confidence" that the North Korean group was linked to the hack.
Over the past few years, agents linked to North Korea have focused on attacking cryptocurrency companies, after major thefts of digital tokens occurred.
Western security agencies have previously said that the stolen money is being used to fund North Korea's nuclear weapons and missile development programs.
The North Korean regime has denied any involvement in past hacking operations.
But Eric Jardine, head of research at Chain Analysis, advised every trading platform to be careful because exchanges are attractive targets for hackers due to the enormous value of the assets.
Binance did not directly respond to BBC questions about possible links to North Korea, but said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”
The incident relates to the hacking of the Binance.com website, while the much smaller cryptocurrency platform Binance.US, which only offers trading services to US residents, was not affected.
Binance co-CEO Richard Ting confirmed the results of the initial investigation and that the hack occurred through a company engineer's laptop.
