New York: Binance, the world's largest cryptocurrency exchange, has reported a theft of more than $6 billion in what blockchain firms and experts believe could be the biggest cryptocurrency heist on record.
The company said on Friday that it had reserved more than $6.34 billion in corporate funds to cover the stolen assets and had begun efforts to recover them for users. Binance has also worked with blockchain partners to freeze approximately $3 billion in affected assets.
The exchange has pledged to cover all losses and has been issuing regular updates on its social media channels as its investigation progresses.
"We are working nonstop to resolve this," Binance co-CEO Richard Teng said in a video posted on X on Friday.
TRANSCRIPT: Hi everyone, firstly, I want to thank you all for the support. Difficult times like these are a great reminder how strong our industry is when we work together. We are grateful to our partners that acted quickly to freeze the hacked assets; to global law enforcement, who we’re working hand in hand with to seek justice; But most of all - we are grateful to our users for their patience and understanding. Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust.I want to be clear: WE ARE COMMITTED TO COVERING ALL HACKED LOSSES THROUGH OUR COMPANY FUNDS. Your assets are safe. The good news is that we are recovering stolen assets for users. Binance has reserved over $6.34B of company funds to cover the stolen assets. $5B of these funds are already held in the exact token assets that were impacted, such as USDC, USDT, BTC, ETH, BNB etc. I know many of you are still asking the same question: how can Binance actually prove that your assets were not affected?Let me be direct about the first point. We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance's own hot wallet. User assets are held under Binance's established security architecture. The vast majority sit in cold wallets, and are only moved into a hot wallet when a user makes a withdrawal.One more thing I want to share. Binance has always been built for the long term. Most of what we earn from day-to-day operations is held in crypto assets. We have kept a lot of them in the company, and reinvested them — into the business, and into security. Because we believe in crypto, and in the long-term value of this industry.That is precisely why we are able to absorb a loss of this size, immediately, with our own money.We are working on the outstanding amount by buying the token assets through market and OTC channels. We will share more progress as soon as we can. If you, as a user, are concerned, we encourage you to check funds on your Binance accounts. Wait for our initial Proof of Reserve for public verification, which is targeting Monday. You can reach out to our customer service with any questions. Next, I want to give you an update on our understanding of the hack itself. Our tech and security teams are still deep in the investigations of the hack. This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate. The attacker used a known multi-signature protocol EIP-7702, to obtain on-chain execution approval over a hot wallet. That delegation did not pass through our normal approval controls. That’s why we need to pause the withdrawal service to investigate, rebuild, and retest the entire infrastructure system. So what are we doing now?First, we are rebuilding the withdrawal service, and we are not switching it back on until it passes rigorous testing. We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours. Second, we are conducting a full security review across the entire company — endpoints, cloud, key management, signing. Everything.Third, we are completing the purchase of the remaining assets and will verify in our Proof of Reserves. We will be sharing a full Proof Of Reserves report by Monday, and we are hoping to give an initial view of Proof of Reserves before that.Fourth, we are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds. We will do everything within our power to ensure that these bad actors will be held accountable.Lastly, this is an industry-wide effort, and we are grateful to partners across the ecosystem who have moved quickly to help and support. We will weather this storm. Thank you for the support - and stay safe.
US President Donald Trump said US officials were investigating the incident. Asked by reporters at the White House whether North Korea was involved, Trump said: "We're looking at that."
The suspected involvement of a North Korean hacking group, the scale of the theft and questions over Binance's security systems have drawn attention to the incident.
Binance said an initial investigation suggested that the incident may have involved a compromised laptop. However, further inquiries uncovered additional "points of breach", the company said on X.
US-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit.
In a post on its website late Thursday, the firm said: "We make this judgment with high confidence."
"An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said, adding that several features of the attack matched previous incidents linked to North Korea.
Chainalysis also believed the hack was likely carried out by TraderTraitor, the firm's co-founder and CEO Jonathan Levin said in a post on X.
Asked about the possible connection to North Korea, a Binance spokesperson said the company was "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice".
Experts say North Korea has increasingly relied on cryptocurrency theft and other illicit cyber activities to generate foreign currency for its economy and fund its nuclear programme, amid international sanctions and other economic difficulties.
In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won in cryptocurrency and other virtual assets over the preceding five years, with more than half of the amount stolen in 2022 alone.
The agency said North Korea's ability to steal digital assets was considered among the strongest in the world.
TRM and several other cryptocurrency firms and experts have described the incident as the largest cryptocurrency theft on record.
However, the full extent of the losses and the amount that can ultimately be recovered remain uncertain.
Approximately half of the stolen assets have been frozen, but some of the remaining funds are already being transferred and converted, according to independent cryptocurrency analyst Garrick Hileman.
He said the hackers could use cryptocurrency mixers or tumblers to make the stolen funds harder to trace by combining them with other digital assets.
"Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler," Hileman said.
"You mix it in with other cryptos, and it's harder to track."
It remains unclear how long it will take the attackers to convert the remaining assets into usable funds, he added.
"There are places in the world where you can take your bitcoin and get that converted," Hileman said.
The reported scale of the Binance theft exceeds the $1.5 billion loss suffered by cryptocurrency exchange Bybit in February 2025. The FBI attributed that attack to North Korea and its TraderTraitor hacking unit.
TRM also cited similarities between the Binance incident and previous attacks linked to the group, including the Bybit hack.
Binance founder Changpeng Zhao said on X that the latest incident might be the largest in dollar value, but previous attacks, including the theft involving cryptocurrency exchange Mt. Gox, had a more substantial impact in terms of the amount of bitcoin affected.
Cybersecurity experts have warned that attacks of this scale could become more common as threats grow more sophisticated.
"A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward, senior vice-president at Absolute Security.
He added that the growing sophistication and spread of cyber threats could lead to an even larger attack with greater financial consequences.
The incident has raised questions about the security controls governing access to Binance's wallets.
Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, questioned why stronger approval requirements were not in place.
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said.
Hot wallets are cryptocurrency wallets connected to the internet and used to facilitate transactions. They hold the private keys that authorise access to digital assets.
In a nearly five-minute video posted on X on Friday, Binance co-CEO Richard Teng confirmed that the exchange's own hot wallet had been affected.
"User assets are held under Binance's established security architecture," he said. "The vast majority sits in cold wallets", which are kept offline for secure storage, "and are only moved into a hot wallet when a user makes withdrawal."
Teng said Binance's technology and security teams were continuing to investigate the incident. He added that the attack was not carried out by a single person and involved complex tactics, including a "self-destruct mechanism" that had made the investigation more difficult.
"We are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds," Teng said.
"We will do everything within our power to make sure that these bad actors will be held accountable."
Binance said deposits had not been affected. Withdrawals, however, had been suspended and were expected to resume within the following one or two days.