On a Thursday in late October, the world's largest cryptocurrency exchange, Binance, acknowledged that $6.3bn in digital assets had been swept up in what may be the largest theft the industry has ever seen. Half of that fortune has been pulled back from the brink through the cooperation of token issuers, while the rest remains in the hands of an attacker whose trail, early signs suggest, leads toward North Korea. It is a reminder that the digital vaults holding so much of the world's new money are only as secure as the people and machines guarding their doors.
Binance Hit by Suspected Record $6.3bn Hack, Linked by Analysts to North Korean Unit
The attacker still holds an enormous sum of stolen assets
Mark
Start with the headline number. Is $6.3bn actually stolen?
Mimi
Binance says $6.3bn in assets was impacted. About half has been frozen, and the company says it will cover all losses.
Luke
Worth noting that "impacted" is Binance's word, and the "largest hack in history" framing comes with it. We don't have an independent accounting of what left the exchange.
Mark
Why were Tether and Circle able to freeze anything?
Mimi
They issue the tokens. Tether froze around $1.6bn, Circle more than $800m. That's about $2.4bn together, and World Liberty Financial said it helped freeze funds too.
Mark
And the North Korea link?
Mimi
Chainalysis says it has high confidence, and TRM Labs says the attack resembles earlier North Korean-linked incidents, including Bybit.
Luke
Both are analytics firms, and resemblance is not proof. Binance wouldn't answer the BBC directly on North Korea. It only said it is working with law enforcement to confirm identities.
Mark
What about the engineer's laptop?
Mimi
Binance calls it an early check. It may have let the attacker make unauthorised withdrawals.
Luke
"May" is carrying a lot there. The cause isn't established, and we don't know how the laptop was compromised.
Mark
What's still open?
Mimi
The attacker still holds a huge sum, so tracing and recovery are far from done, and withdrawals remain disabled.
Luke
Also unknown is how the frozen half and the loss pledge fit together, since the reporting gives no detail on either.
Il Polso
- Binance reports $6.3bn in digital assets affected, the largest hack on record, and withdrawals are frozen for now.
- A compromised engineer's laptop appears to have let an attacker make unauthorised withdrawals, with the mechanics still unexplained.
- Tether and Circle have frozen roughly $2.4bn between them, but a large share of the stolen funds remains with the attacker.
- Two analytics firms tie the attack to North Korea's TraderTraitor, while Binance says it is working with law enforcement to identify the criminals.
- Bitcoin fell more than 4% and other major coins dropped sharply as markets absorbed the news.
On a Thursday in late October, the world's largest cryptocurrency exchange, Binance, acknowledged that $6.3bn in digital assets had been swept up in what may be the largest theft the industry has ever seen. Half of that fortune has been pulled back from the brink through the cooperation of token issuers, while the rest remains in the hands of an attacker whose trail, early signs suggest, leads toward North Korea. It is a reminder that the digital vaults holding so much of the world's new money are only as secure as the people and machines guarding their doors.
On Thursday, Binance, the world's largest cryptocurrency exchange, said that $6.3bn in digital assets had been affected by what it described as the largest hack in history. About half has since been frozen with help from other platforms, and the company has pledged to cover every loss. Early checks point to a compromised laptop belonging to an engineer, which allowed an attacker to make unauthorised withdrawals. The company has not yet explained the mechanics in detail.
Two analytics firms have linked the attack to TraderTraitor, a North Korean hacking unit. TRM Labs said several elements resemble earlier North Korean-linked incidents, including the 2025 Bybit hack, which was then a record at $1.5bn. Chainalysis said it has high confidence in the attribution. Binance has not directly confirmed the North Korea link, saying only that it is working with law enforcement to identify the criminals.
The freezing effort came from the companies that issue the tokens involved. Tether and Circle have together frozen about $2.4bn. Binance co-chief executive Yi He thanked the issuers and told users that withdrawals will stay disabled until the environment is confirmed secure. Markets reacted quickly, with Bitcoin falling more than 4%. Analysts caution that the attacker still holds a large sum, so the work of tracing and recovering the funds is far from over.
On Thursday, Binance, the world's largest cryptocurrency exchange, said that $6.3bn (£4.7bn) in digital assets had been affected by an incident it described as the largest hack in history. About half of that sum, the company said, has been frozen with help from other platforms, and Binance has pledged to cover all losses.
The company's early checks point to a compromised laptop belonging to an engineer, which it says allowed an attacker to make unauthorised withdrawals. That is a preliminary finding, and Binance has not described the mechanics in more detail. The incident concerns Binance.com. Binance.US, the much smaller platform serving American residents, said it was not affected, and Coinbase said it was unaffected and was monitoring the situation.
Two analytics firms have attributed the attack to TraderTraitor, a North Korean hacking unit. TRM Labs said in a report that several elements of the attack resemble earlier North Korean-linked incidents, including the 2025 hack of the Bybit exchange, which was a record at $1.5bn and is now dwarfed by this one. Chainalysis said it has high confidence in the link. Binance did not directly answer BBC questions about North Korea, saying only that it is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.
Ari Redbord, TRM Labs' global head of policy, told the BBC the hack is a watershed moment, unlike anything the industry has seen. He cautioned that the attacker still holds an enormous sum of stolen assets, so efforts to trace and recover the funds are far from over. Eric Jardine, Chainalysis' Head of Research, urged every exchange to stay vigilant, noting that platforms are attractive targets because of the sheer value they hold.
The freezing effort came from the companies that issue the tokens involved. Tether and Circle said they have frozen about $2.4bn combined. Tether CEO Paolo Ardoino put his firm's share at around $1.6bn, tied to what he called a potential Binance exchange hack, and said protecting the industry and its partners was the priority. Circle, issuer and co-creator of the USDC dollar-backed coin, said it had frozen more than $800m; its chief executive, Jeremy Allaire, said the company was closely tracking reports of a potential exploit involving Binance. World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it had worked with partners to freeze stolen funds.
Binance co-chief executive Yi He thanked the issuers in a series of posts. She also told users that withdrawals are disabled for now, saying safety comes first until the environment is confirmed to be secure.
The scale of the platform explains the weight of the news. Founded in China in 2017, Binance is estimated to have more than 300 million registered users worldwide, and said in 2024 that it held over $160bn in assets under custody. It has faced regulatory scrutiny around the world. Several crypto industry observers had flagged concerns about a possible hack hours before the exchange confirmed the problem.
Markets reacted quickly. Bitcoin fell by more than 4% after the alerts, and Ethereum and Solana also dropped sharply. What to watch next: when withdrawals resume, whether Binance confirms the North Korea attribution, and how much of the roughly half of the funds still in the attacker's hands can be traced.
Citazioni salienti
Safety first: withdrawals are currently disabled until the environment is confirmed to be secure.— Yi He, Binance co-chief executive
The Binance hack is a watershed moment, unlike anything the industry has seen.— Ari Redbord, TRM Labs global head of policy (paraphrased)
Vuoi la storia completa?
Leggi l'originale su BBC News ↗
Technology