Binance, the world's largest cryptocurrency exchange, stated that in a "complex" hacker attack, approximately half of the stolen funds have been frozen. Previously, it was believed that this incident could be a record-breaking theft, involving an amount of $6.3 billion (£4.7 billion).
The company stated that $3 billion worth of stolen digital assets have been secured, but there is still a large amount of funds in the hands of unidentified hackers. Binance initially believed that the unauthorized withdrawals were due to an intrusion into an engineer's laptop, but later indicated that the scope of the attack was broader.
Several analysis firms have linked this hacking attack to a North Korean hacking unit. The scale of this attack exceeds the $1.5 billion (1.12 billion pounds) theft case that occurred at the Bybit exchange in 2025.
The U.S. Secret Service stated that they are working "around the clock" to "identify, freeze, track, and recover" the stolen funds.
The major U.S. federal agency responsible for investigating financial crimes added that it will "identify the responsible cybercriminals and bring them to justice." Binance also stated that it is cooperating with the Federal Bureau of Investigation (FBI).
Although Binance stated that its exchange for US users was not affected, the United States still has jurisdiction to investigate this hacker attack and assist in tracking the stolen funds – such work usually requires collaboration among global law enforcement agencies.
This hacker attack also involved some assets related to the United States, such as the US dollar-pegged stablecoins Tether and Circle.
Binance tells users: 'Your money is safe, and we will bear every loss.'
The company initially suspended all deposit and withdrawal services, but later stated in an update that "deposits were not affected."
Who could be behind the hacker attack on Binance, and what we know so far
Anbin's Co-CEO, Richard Teng, stated: "This is not the work of one person. Our initial investigations indicated that this security incident might involve a compromised laptop, but subsequent investigations revealed more entry points for the intrusion."
Teng also stated that the hackers used a 'self-destruction mechanism' to destroy their tools and traces during the operation, making tracking and investigation even more difficult.
Initially, the company stated that the intrusion "may have begun with the compromise of a laptop belonging to an engineer with the username DevOps," but subsequent statements indicated that the scope of the incident was broader.
In subsequent updates, the company stated that it has "reserved" over $6.34 billion from its funds to cover the stolen assets and is also "actively buying" a range of cryptocurrency tokens.
Binance was attacked by hackers, which scared the cryptocurrency market on Friday. During the trading session in New York on Friday afternoon, the price of Bitcoin fell by 5% to $76,800.
Cryptocurrency exchange Coinbase fell by 12%, and investors also reacted to its financial report, as the company's reported revenue was slightly lower than expected. Financial company Robinhood that provides cryptocurrency trading services fell by 7.8%.
Binance was established in 2017, with its headquarters initially located in China. It allows users to trade digital assets and is estimated to have over 300 million registered users worldwide.
In 2024, the company stated that its managed assets exceeded $160 billion.
At present, what Binance users and the entire crypto industry are most concerned about is whether Binance truly has the ability to make up for this huge loss.
The company has repeatedly stated that customer funds will be covered, and that the company has sufficient strength to overcome these difficulties.
However, those who follow the history of cryptocurrency have pointed out online that this is exactly in line with what FTX CEO Sam Bankman - Fried stated before the collapse of their cryptocurrency exchange in 2022, which resulted in huge losses for customers and the entire industry.
Several experts have warned customers not to regard Binance's commitment to cover losses as legally binding, stating that they may need to pursue legal action to recover their losses.
The Daniel Tunkel from the London law firm Edwin Coe stated that this will "depend on what is promised to the client in the contract," as well as "where Binance could be sued for non-performance if that situation indeed arises."
Binance has always been under global regulatory scrutiny.
Meanwhile, the artificial intelligence-driven research firm TRM Labs stated that several characteristics of this attack are similar to previous incidents related to North Korea, including the Bybit hacking incident.
In the past five years, the crypto industry has continuously suffered significant losses due to hackers.
In nearly all cases, investigators have attributed the responsibility to North Korean hackers, pointing to the notorious Lazarus Group — also known as TraderTraitor. These names refer to cybercrime groups alleged to work directly for that regime.
Chain analysis firm Chainalysis stated that it is “highly confident” that North Korea is involved in this hacking attack.
North Korea is a poor country with a weak industrial base and is subject to severe international sanctions. Experts say that the regime uses cybercrime as a means of fundraising.
North Korea has always denied this, but there is a wealth of persuasive evidence from the analysis of cryptocurrency funding flows and interviews with defectors who have escaped the country.
This makes it very likely that North Korea will become the only country to use hacking as a means of raising public funds.
AI The gold rush is pulling crypto companies away from Bitcoin
Meet the crypto billionaires who created a world where "money can buy voting rights"
