A company that stands among the largest gateways for digital money has discovered that a vast sum, more than six billion dollars, slipped through its defenses, and it now races to freeze what it can while promising every customer will be made whole. Analysts trace the theft to a state-linked hacking unit in North Korea, a regime that has long funded itself through digital plunder, so the episode reads less as an isolated break-in than as another chapter in an old struggle between open financial systems and those who would exploit them. Whether the promise of repayment holds will depend on pati
Binance Freezes Half of $6.3bn Stolen in Record Hack Linked to North Korean Hackers
More than four times the previous record, and half of it still unaccounted for
Mark
Start with the headline number. Half the money is frozen. Is that a win?
Mimi
It's the best news in the story. About $3bn is secured out of $6.3bn. But the other half is still with hackers nobody has identified.
Luke
And the $3bn is Binance's own statement. I don't see independent confirmation of what's frozen or where the rest has gone.
Mark
The explanation of how it happened shifted too.
Mimi
Yes. First it was one DevOps engineer's laptop. Then Richard Teng said it wasn't one person and that there were additional points of breach.
Luke
So the cause is still unsettled. The self-destruct mechanism he described makes the investigation harder, and that's his account, not a finding.
Mark
What about North Korea?
Mimi
Several analytics firms link it, TRM Labs on resemblances to Bybit, Chainalysis with high confidence.
Luke
High confidence isn't proof. It's analysis from firms outside the investigation, and North Korea denies this kind of activity.
Mark
And customers? Binance says every loss is covered.
Mimi
It set aside over $6.34bn and is buying tokens. But experts say the promise may not be legally binding, and Edwin Coe's Daniel Tunkel says it depends on the contracts.
Luke
The FTX comparison is online commentary, not evidence Binance is in trouble. Whether it can cover the loss is still unknown.
El Pulso
- A stunning $6.3bn was drained from Binance, dwarfing the previous record crypto heist by more than fourfold.
- Binance has frozen roughly half the stolen funds, yet most of the money still sits with unidentified attackers.
- The company's explanation has shifted from one compromised laptop to multiple breach points, unsettling customers and analysts alike.
- Investigators, including US authorities and the FBI, are racing across borders to trace and recover the remaining assets.
- Binance has pledged to cover every loss, but experts warn that promise may not be legally binding, leaving users uncertain.
A company that stands among the largest gateways for digital money has discovered that a vast sum, more than six billion dollars, slipped through its defenses, and it now races to freeze what it can while promising every customer will be made whole. Analysts trace the theft to a state-linked hacking unit in North Korea, a regime that has long funded itself through digital plunder, so the episode reads less as an isolated break-in than as another chapter in an old struggle between open financial systems and those who would exploit them. Whether the promise of repayment holds will depend on patience, law, and the trust a community places in those who hold its wealth.
Binance, the world's largest cryptocurrency exchange, says it has frozen about half of the $6.3bn taken from it in what is believed to be the biggest crypto heist on record. The previous high was a $1.5bn theft from Bybit in 2025, so this attack is more than four times larger. Several analytics firms link it to a North Korean hacking unit, and Chainalysis reports high confidence in that attribution.
The company's account has also shifted. It first pointed to a compromised laptop belonging to a DevOps engineer, but co-CEO Richard Teng later said the attack was not carried out by one person and that several breach points were found. Attackers also used a self-destruct mechanism that wiped tools and traces as they moved.
The response now runs through law enforcement. The US Secret Service and the FBI are working to trace and recover the funds, and Binance says its US exchange was unaffected. For customers, the message has been reassurance: deposits were restored, more than $6.34bn in company funds has been set aside, and every loss will be covered. Yet experts caution that this pledge may not be legally binding, and users might have to sue to get their money back.
Markets reacted sharply, with Bitcoin falling 5% and Coinbase dropping 12%. Many observers have recalled that FTX also promised safety before its 2022 collapse. What comes next depends on whether the frozen and remaining funds can be recovered, and whether Binance can keep its word.
Binance, the world's largest cryptocurrency exchange, says it has frozen roughly half of the $6.3bn (£4.7bn) taken from it in what is believed to be the biggest crypto heist ever. The company describes the attack as complex. By its account, about $3bn of the stolen digital assets has been secured, but a large share remains in the hands of hackers who have not been identified.
The scale is easier to grasp by comparison. The previous record was the $1.5bn (£1.12bn) theft from the Bybit exchange in 2025, and this one is more than four times that size. Several analytics firms have tied the Binance attack to a North Korean hacking unit. TRM Labs said several elements of it resembled earlier North Korean-linked incidents, Bybit among them. Chainalysis said it had high confidence that a North Korean actor was involved.
Binance's own explanation of the breach has changed. At first it indicated the intrusion may have begun with a compromised laptop belonging to a DevOps engineer, which allowed unauthorised withdrawals. Co-CEO Richard Teng later said that was not the whole picture. "This was not carried out by one person," he said, adding that further investigation had uncovered additional points of breach. He also said the attackers used a self-destruct mechanism that wiped out tooling and traces as they moved, making the trail harder to follow.
The response now runs through law enforcement. The US Secret Service said it was working around the clock to identify, freeze, trace and recover the stolen funds, and to bring those responsible to justice. Binance said it is working with the FBI. The company says its US-facing exchange was not affected, but the hack touched some US-linked assets, including the dollar-pegged stablecoins Tether and Circle, so US authorities would still have jurisdiction. Tracking stolen crypto generally takes a global effort across agencies.
For customers, the main message from Binance has been reassurance. It told users their money is safe and that it is covering every loss. It first suspended all deposits and withdrawals, then said deposits remained unaffected. In a later update it said it had set aside more than $6.34bn in company funds to cover the stolen assets and was actively buying a range of crypto tokens.
Markets reacted on Friday. Bitcoin fell 5% to $76,800 in afternoon trading in New York. Coinbase dropped 12%, though investors were also responding to quarterly results with revenue slightly below expectations. Robinhood, which also trades cryptocurrency, was down 7.8%.
The stakes are large because of Binance's size. It was founded in China in 2017, is estimated to have more than 300 million registered users, and said in 2024 that it held more than $160bn in assets for customers. The worry among users and across the industry is whether it can absorb a loss this big. Binance has said repeatedly that it is strong enough to weather it. Crypto-history watchers online have noted that FTX chief Sam Bankman-Fried gave similar assurances before his exchange collapsed in 2022, leaving customers and the industry with huge losses.
Several experts have warned that Binance's pledge should not be treated as legally binding, and that customers might have to sue to recover losses. Daniel Tunkel of London law firm Edwin Coe said it would come down to what customers were promised in their contracts, and where Binance could be sued for non-performance. Binance has also faced regulatory scrutiny around the world.
The North Korean link fits a pattern. Over the past five years, investigators have blamed North Korean hackers for nearly all of the industry's enormous hack losses, often naming the Lazarus Group, also known as TraderTraitor, clusters of cybercriminals accused of working directly for the regime. Pyongyang denies this, but experts point to cryptocurrency flow analysis and interviews with defectors. Heavily sanctioned and with little industry, North Korea is likely the only nation using hacking to raise public funds. What to watch next is whether investigators recover the frozen and remaining funds, and whether Binance can make good on its promise.
Citas Notables
This was not carried out by one person. Our subsequent investigation has uncovered additional points of breach.— Richard Teng, Binance co-CEO
Whether customers can sue would come down to what they have been promised in their contracts.— Daniel Tunkel, Edwin Coe law firm (paraphrased)
Quieres la nota completa?
Lee el original en BBC News ↗
Technology