Binance hack: $6.3bn stolen, users promised full cover, and North Korea suspected but unproven

The Binance hack, which Binance puts at roughly $6.3bn (£4.7bn), is believed to be the largest theft in cryptocurrency history. It has sent a jolt through an industry used to security scandals. The exchange says customers will not lose out, but several questions remain open, including who did it and how much of the money can be clawed back.

How the Binance hack unfolded

The first signs came from crypto watchers on X, who noticed large sums leaving wallets linked to Binance. Founder Changpeng Zhao then confirmed a problem. Binance later said its early investigation pointed to a compromised laptop belonging to a DevOps engineer. That access, it said, let an attacker reach a service container and submit unauthorised withdrawals.

Co-chief executive Richard Teng stressed it was not a simple “one-click” break-in. He later said more than one person was involved, and that the attackers used sophisticated methods to cover their tracks, including a “self-destruct mechanism”. Security experts quoted by the BBC suggested an engineer may have been tricked into running something like a test, allowing malware onto a machine with enough privileges to act as a direct route into production systems and then to the wallets. As one cybersecurity executive put it, a vault is only as safe as the people holding the keys.

Only Binance’s main global exchange, Binance.com, was affected. Binance.us, which serves US residents, says it was not.

What was taken

Estimates circulating online ranged from $2bn to $8bn before Binance settled on its $6.3bn figure, and the final tally could take days to establish. Early reports, cited by Fortune, say about $1.5bn was in Bitcoin and a similar amount in the Tether stablecoin. Slightly under $1bn was reportedly in Ethereum and the USDC stablecoin, with other tokens likely taken as well.

Who is behind the Binance hack?

Nobody has claimed responsibility, and Binance has not named a culprit. Some analytics firms, including TRM Labs, have pointed towards North Korea. They say elements of the attack resemble earlier incidents, such as the $1.5bn ByBit theft in 2025, which was linked to the Lazarus Group, also known as TraderTraitor. Fortune reports that TRM and others consider North Korea almost certainly responsible, but both outlets stress there is no definitive proof.

The theory is plausible. Oxford academic Dr Edward Howell told the BBC that Pyongyang has a long record of using cyber operations to raise cash, and estimated that 40-50% of its weapons programmes are funded this way. North Korea has consistently denied involvement in such attacks, and Binance has not directly addressed the possible link.

Is my money safe?

Binance says user funds are safe. It temporarily suspended deposits and withdrawals as a precaution. It says it will cover all losses from an emergency reserve built for such events, topped up with company money if needed. Fortune notes that rivals, including Coinbase and Tether, pledged support. Markets appear to have taken that reassurance on board: Bitcoin and Ethereum fell around 3%, a dip that coincided with a broader market sell-off.

Recovery is another matter. Binance says it is working with partners to freeze stolen assets and that about $3bn has reportedly been located. Tether and Circle, which issue USDT and USDC, said they would freeze stablecoins tied to the theft. But Fortune reports evidence that the hacker quickly deposited stolen funds on the lending platform Aave as collateral for an Ethereum loan. If so, the thief could walk away with the borrowed Ethereum even if the collateral is frozen, so freezes may only be partly effective.

What users should do now

Experts advise checking balances only through the official Binance app or a web address you already trust. Crisis moments like this are prime time for scammers, so the warning signs include:

• emails claiming your funds are at risk;
• fake support accounts offering help;
• messages urging you to move your crypto to a “safe” wallet.

Never share passwords, verification codes or wallet recovery phrases, and avoid links in unsolicited messages.

The bigger picture

The incident lands on a company that has faced scrutiny before. Zhao resigned as chief executive in 2023 after pleading guilty to money laundering violations, and a US lawsuit last year accused the firm of helping send money to designated terrorist groups. Binance said in 2024 that it held more than $160bn in assets, which helps explain why it can promise to absorb the loss.

Some people online have questioned how one compromised laptop could open the door to billions. Binance promised fuller details soon, and the answers will matter for confidence in the exchange.

Explore more on this topic with Vexel Search.

File photo: 5 years birthday Binance cake in Paris – 2022-07-08.jpg by Bretwa, CC BY-SA 4.0, via Wikimedia Commons.