Cryptocurrency exchange Binance is working to contain a major cyberattack estimated to have affected approximately $6.3 billion in digital assets, with nearly half of the impacted funds frozen as the company coordinates recovery efforts with law enforcement agencies and blockchain security specialists.
The world’s largest cryptocurrency exchange by daily trading volume confirmed on Friday that its investigation had uncovered additional security breaches, suggesting that the incident was more complex than initially believed.
In a statement published on X, Binance described the incident as a “complex attack” and said it was taking all necessary measures, in cooperation with law enforcement authorities, to address the breach and limit further losses.
The company initially suspected that the attack originated from a compromised laptop belonging to a DevOps engineer, which allegedly enabled unauthorized access to a service container and the execution of fraudulent withdrawal transactions.
However, subsequent investigations revealed additional points of compromise, prompting the exchange to expand its security assessment.
Binance estimated the total financial impact at around $6.3 billion, although it cautioned that the figure could rise as investigations continue and additional affected assets are identified.
The company said approximately $3 billion in assets had already been frozen, preventing the attackers from accessing or transferring a substantial portion of the affected funds.
Binance also sought to reassure customers that their funds remained protected, while pledging to cover all losses resulting from the incident.
The exchange emphasized that it had found no evidence of private key leaks from its wallets and promised to publish a comprehensive technical report once the investigation is completed.
Binance Coordinates With Crypto Companies to Freeze Funds
The scale of the incident has triggered a coordinated response across the cryptocurrency industry, with major digital asset companies taking steps to identify and immobilize funds potentially connected to the attack.
Tether Chief Executive Paolo Ardoino said his company had frozen approximately $1.6 billion in assets linked to a potential Binance exchange hack.
Meanwhile, Circle Chief Executive Jeremy Allaire announced that his company had frozen more than $800 million in USDC, another major dollar-pegged stablecoin.
USDT and USDC are among the world’s largest stablecoins, digital currencies designed to maintain a relatively stable value by being pegged to traditional currencies, primarily the US dollar.
Binance said it was working with law enforcement agencies, cryptocurrency issuers, blockchain intelligence firms and industry partners to trace the movement of stolen assets and prevent further transfers.
The company had temporarily suspended deposits and withdrawals as part of its initial response. However, it later indicated that deposits remained unaffected and that it was targeting a resumption of withdrawals within approximately 45 hours, according to its Friday update.
North Korea-Linked Hacking Group Suspected
Blockchain intelligence firm TRM Labs said it had a high level of confidence that the attack was carried out by TraderTraitor, a hacking group associated with North Korea, citing intelligence gathered both on and off blockchain networks.
According to TRM Labs, several characteristics of the Binance incident resembled previous cyberattacks attributed to North Korean-linked hackers.
TraderTraitor is believed to be associated with the Lazarus Group, a notorious cybercrime organization that has been linked to several major international hacking operations.
The group gained widespread attention in 2014 after being accused of hacking Sony Pictures Entertainment in connection with the release of the film “The Interview,” which portrayed a fictional plot involving North Korean leader Kim Jong Un.
The same hacking network has also been linked to major cryptocurrency thefts, including the February 2025 attack on Bybit, in which approximately $1.5 billion was stolen.
If Binance’s estimated losses are confirmed, the incident would represent a cyberattack on a scale more than four times larger than the Bybit breach, which had previously been considered the largest cryptocurrency theft on record.
Cryptocurrency Markets Come Under Pressure
News of the attack triggered a sharp sell-off across major cryptocurrency markets, with investors reacting to concerns over the security of digital asset platforms and the potential consequences for market liquidity.
Bitcoin and Ethereum fell by nearly 5% and 6%, respectively, while Binance’s native token, BNB, recorded a decline of approximately 10%.
Stablecoins largely avoided the same level of volatility, reflecting their design to maintain a stable value against traditional currencies.
The incident has also renewed concerns about the growing sophistication of cyberattacks targeting digital financial infrastructure, particularly as artificial intelligence technologies continue to advance.
Market observers have increasingly warned that more powerful AI models could create new challenges for cybersecurity systems, encryption technologies and the security protocols used by cryptocurrency exchanges.
As investigations continue, Binance faces the challenge of restoring normal operations, recovering affected assets and maintaining user confidence in the security of one of the world’s largest cryptocurrency trading platforms.
