Crypto giant Binance hit by hack suspected to be largest in history

Cryptocurrency giant Binance announced on Thursday that a staggering $6.3 billion (£4.7 billion) in digital assets have been impacted by what is being widely described as the most significant crypto hack on record. The sheer scale of the breach dwarfs previous incidents, sending shockwaves through the global financial technology sector and raising urgent questions about the security of digital assets. While Binance stated that approximately half of the affected assets have been successfully frozen, a substantial portion remains in the possession of the perpetrators, underscoring the immense challenge of full recovery. The exchange has unequivocally committed to "cover all losses," a move intended to reassure its vast user base and mitigate potential fallout, yet the financial and reputational implications are profound.

Initial investigations by Binance pointed towards a compromised engineer’s laptop as the point of entry, a scenario that would allow an attacker to initiate unauthorized withdrawals. However, the firm’s subsequent and more in-depth analysis has revealed "additional points of breach," suggesting a more sophisticated and multi-faceted attack than initially apprehended. This evolving understanding highlights the adaptive nature of cyber threats and the constant need for robust, multi-layered security protocols.

The incident has been attributed by two prominent analytics firms, Check Point and TRM Labs, to North Korea’s notorious hacking unit, widely known as the Lazarus Group, also identified by Check Point as "TraderTraitor." This attribution is particularly concerning, as the Lazarus Group has been previously implicated in significant cyber heists, including a $1.5 billion hack on the Bybit exchange in 2025, which was itself a record-breaking event until this latest incident. Jayant Dave, Chief Information Security Officer at Check Point, emphasized the unprecedented nature of the losses, stating that the estimated figures make it "the largest crypto theft on record."

TRM Labs, an AI-powered investigations company, further bolstered these claims in a detailed report, noting that several hallmarks of the Binance attack bear a striking resemblance to earlier incidents linked to North Korea, including the aforementioned Bybit hack. Ari Redbord, TRM Labs’ Global Head of Policy, described the Binance hack as a "watershed moment" for the cryptocurrency industry, an event unlike anything witnessed before. Redbord also cautioned that efforts to trace and recover the stolen funds are far from concluded, given the "enormous sum of stolen assets" still held by the attacker.

Binance, a titan in the cryptocurrency space, was founded in China in 2017 and has grown exponentially to become the world’s largest crypto exchange by trading volume. It facilitates the trading of a vast array of digital assets and boasts an estimated user base exceeding 300 million registered users globally. In 2024, the company reported holding over $160 billion in assets under its custody, a figure that underscores its systemic importance within the digital economy. However, this scale also makes it an exceptionally attractive target for malicious actors. The exchange has also been under considerable regulatory scrutiny across various jurisdictions, a factor that could amplify the impact of this security breach.

Chainalysis, another leading crypto analytics firm, has also expressed "high confidence" in linking the North Korean group to the hack, further solidifying the consensus among cybersecurity experts. For several years, operatives linked to North Korea have been increasingly active in targeting cryptocurrency companies, orchestrating large-scale thefts of digital tokens. Western security agencies have consistently alleged that these stolen funds are channeled to finance the regime’s clandestine nuclear weapons and missile development programs. Despite repeated accusations, the North Korean regime has consistently denied any involvement in such illicit activities.

Eric Jardine, Chainalysis’ Head of Research, issued a stark warning to all exchanges, urging them to remain exceptionally vigilant. He highlighted that cryptocurrency platforms represent prime targets for hackers due to the sheer concentration and value of the assets they hold. In its official response to the incident, Binance did not directly address the potential links to North Korea but stated, "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice." This statement suggests a coordinated effort with global authorities to apprehend those responsible.

It is important to note that the security incident specifically concerns Binance.com. The company’s much smaller affiliate, Binance.US, which operates exclusively for American residents and offers trading services tailored to that market, has confirmed that its platform remains unaffected by the breach. This distinction is crucial for users of Binance.US, providing them with a degree of reassurance.

Binance co-CEO Richard Teng elaborated on the initial findings, reiterating that the hack appears to have originated from a compromised engineer’s laptop. He explained that this compromise granted an attacker access to a "service container," which was then exploited to submit unauthorized withdrawal transactions. Teng clarified that the breach was not a simple, single-action event, stating, "the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process." He also confirmed that, to date, the investigation has found no evidence of any wallet private key leaks, which would represent an even more catastrophic compromise. A comprehensive "post-mortem" report is expected to be released once the investigation reaches its conclusion.

In a subsequent update posted on X, the company acknowledged that further investigation had uncovered "other breach points," indicating a deeper and more intricate attack vector than initially identified. The statement read, "We are still gathering the facts, and will share more directly as we have them." This evolving understanding of the breach’s complexity underscores the challenges faced by security teams in rapidly responding to sophisticated cyberattacks.

Check Point’s Dave drew parallels between the Binance hack and a previous incident involving the crypto exchange platform Bitget in September, where $388 million (£289 million) was lost. He posited that this similarity implies a shift in attack strategies, stating, "This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them." This observation suggests a growing trend of social engineering and insider threat exploitation in large-scale crypto heists.

In a series of posts on X, Yi He, Binance’s co-chief executive, expressed gratitude to various cryptocurrency issuers for their swift action in freezing the compromised assets. She stated, "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," a necessary measure to prevent further illicit outflows. Two other major crypto platforms, Tether and Circle, confirmed that they had frozen a combined total of approximately $2.4 billion in assets in response to the potential Binance hack, demonstrating a crucial industry-wide collaborative effort in combating such threats.

World Liberty Financial, a cryptocurrency company reportedly linked to former US President Donald Trump and his family, also announced that it had collaborated with its partners to freeze a portion of the stolen funds, signaling a broad response across different entities within the financial ecosystem. Meanwhile, crypto exchange Coinbase reported that it was unaffected by the incident and was actively monitoring the situation, a common practice for major platforms during significant industry-wide security events.

Significantly, several observers within the crypto industry had raised concerns about a potential security issue on Binance hours before the exchange officially confirmed the breach. This pre-emptive flagging suggests that sophisticated threat intelligence mechanisms are in place within the crypto community, although timely action was not enough to prevent the massive loss. The news of the hack had an immediate and negative impact on the market. Bitcoin experienced a drop of more than 4%, and the prices of other major cryptocurrencies, including Ethereum and Solana, also saw sharp declines, illustrating the interconnectedness of the crypto market and its sensitivity to major security events.