What we know so far about the Binance hack

Binance, the world's largest crypto exchange, has been hit by what is believed to be the largest crypto hack ever at $6.3bn (£4.7bn).

Crypto is a type of digital asset which does not exist physically like cash or coins. Instead, people use digital wallets on their smartphones or computers to access and manage it.

Richard Teng, Binance's co-chief executive officer, said it is working with the authorities to work out what has happened and it will cover all losses.

Here's what we know so far.

Binance is the world's largest cryptocurrency exchange by trading volume, where people can buy, sell and trade digital currencies, like Bitcoin, as well as deposit and withdraw them.

It was founded in China in 2017 and has hundreds of millions of registered users worldwide.

The exchange has come under scrutiny over the past few years - notably in 2023, when its then-chief executive, Changpeng Zhao, resigned after pleading guilty to money laundering violations.

Last year, a lawsuit in the US accused the company of helping send millions of dollars to US-designated terrorist organisations.

In 2024, the company said it has more than $160bn in assets.

The hack happened to Binance's global centralised exchange, Binance.com.

Binance.us, which provides trading services specifically for US residents, said it has not been affected by the issue.

In a statement, Teng said: "Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop.

"That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions."

He said the hack "was not a simple 'one-click' action" but a "more complex attack process".

Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean an engineer was "talked into taking a test" and malware - malicious software – "landed on their laptop while they did it".

Because the laptop already had sufficient security privileges, Nandakumara said early reports suggest it became "the attacker's route straight into production, and from there to the wallets".

"You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened," said Dr Clive Summerfield, head of FARx, a biometrics in AI security company.

It is not yet known who is behind the attack, but some analytics firms have pointed to North Korea - though this has not been confirmed.

AI-powered investigations company TRM Labs said in a report several elements of the Binance attack resembled earlier incidents linked to the territory, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025.

These previous attacks have been linked to a cluster of cyber-criminals accused of working directly for the regime called the Lazarus Group - also known as TraderTraitor.

North Korea has always denied any involvement in these attacks; Binance has not directly responded to BBC queries about the incident's potential links to the area.

In his earlier statement, Teng said Binance users' funds are safe and, as a precaution, all deposits and withdrawals had been temporarily suspended.

He said the firm would cover all losses from its emergency reserve set up for such situations, and make up the rest with company funds.

Binance said it had been working with partners to freeze the affected assets, with around $3bn reportedly located so far.

"We are still on track towards the expected timeline to resume the withdrawal service in 45 hours," it said.

Users from other crypto platforms have also been warned to be wary of hackers seeking to exploit the situation.

Marijus Briedis, NordVPN's chief technology officer, said people should be on the lookout for things such as "an email claiming your funds are at risk", "a fake support account offering help" or "a message urging you to move your cryptocurrency to a 'safe' wallet".

"Check updates through the Binance app or a website address you already trust," he said.

"Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase."

Jennifer Craven, an international commercial fraud expert at the law firm Pinsent Masons, said the repercussions of the hack could "extend well beyond Binance".

"More broadly, the incident exposes the fragility of parts of the crypto ecosystem," she said.

"If a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what that means for smaller, less mature platforms and currencies."

She said the attack would likely accelerate scrutiny of how the sector protects both its infrastructure and its customers.

Although there is no evidence yet that AI was used in this attack, it fits into a much wider concern in the financial industry of whether AI agents could potentially identify weaknesses in software and work out how to exploit them much faster than human hackers.

The Bank of England has warned, external this could leave institutions struggling to fix vulnerabilities before attackers take advantage of them.

Crypto has become an increasingly popular way of investing and transferring money online, partly because, unlike traditional currencies, it is not controlled by central banks or governments.

This makes it popular for people who think decentralisation can bring financial freedom.

But it also makes it extremely volatile, with it rising and falling in value at the whim of buyers and sellers.

According to Solcard, a crypto-funded prepaid payment and virtual card platform, somewhere between 560 million and 741 million people own crypto worldwide in 2026.