Binance reports $6 billion crypto theft, investigators point to North Korean hackers

Hackers accessed digital wallets at Binance and withdrew over $6 billion in cryptocurrency on Thursday, creating the largest recorded crypto theft. Binance said its investigation traced the intrusion to an engineer’s laptop that allowed an attacker to access a service container and submit unauthorized withdrawal transactions.

The exchange announced it would cover all losses from its own funds and an emergency assets reserve, and it temporarily halted deposits and withdrawals while security checks continue. Binance also revoked the compromised address authorization and is working with law-enforcement agencies and blockchain-intelligence partners to trace and recover the assets.

Analysts described the incident as the biggest hack in the sector’s history. Crypto-tracing firm TRM Labs linked the theft to an elite North Korean hacking unit based on on- and off-chain intelligence. Pangolin Intelligence, a Singapore-based blockchain-tracking firm, reached a similar conclusion, noting that the on-chain activity matched patterns from previous incidents involving the same North Korean cyber unit. A Chainalysis spokesperson said the firm is monitoring the stolen funds as they move across multiple blockchains and expressed high confidence that North Korea was behind the hack.

The U.S. FBI and Secret Service have been contacted for comment, as has North Korea’s mission to the United Nations, which has previously denied hacking allegations. If confirmed, the attack would follow a prior record-high crypto hack attributed to North Korean actors that stole $1.5 billion from the Bybit exchange.

Binance was founded in 2017 by Changpeng Zhao, who stepped down in 2023 after pleading guilty to anti-money-laundering violations and was later pardoned by President Donald Trump. Zhao, still the largest shareholder, said on X that the incident appears to be a hack and that user funds will be fully covered by the exchange.

Bitcoin and Ether prices fell after the breach was reported but recovered partially, trading 2-3 % lower by midday Friday in Hong Kong.