Binance says $6.3bn stolen in biggest crypto heist in history: What we know 

Binance, the world’s largest cryptocurrency exchange, says hackers have stolen about $6.3bn in what appears to have been the biggest crypto heist on record.

The company, which was co-founded by the Chinese-born Canadian billionaire Changpeng Zhao, suspended deposits and withdrawals on Thursday and said it would cover all losses, telling Al Jazeera in a statement that user funds were “safe”.

Two United States blockchain analysis firms have claimed the attack originated in North Korea.

So how did it happen, and what does it mean for the crypto market? Here’s what you need to know:

What happened?

Blockchain analysis firms TRM Labs and Chainalysis say most of the theft unfolded over about 20 minutes, starting late on Thursday.

“An attacker moved approximately 6.36 billion USD out of Binance wallets on 10 blockchains,” TRM reported.

That dwarfs the previous record of $1.5bn, which was stolen from the exchange Bybit in February 2025.

Binance said about $3bn of that has since been frozen, including more than $2.3bn by stablecoin issuers Tether and Circle, according to the Reuters news agency.

Binance has not stated what has happened to the remaining $3.3bn.

It also warned on X that the $6.3bn figure “may continue to increase” as the company works to trace and freeze more assets.

Who carried out the heist and how?

North Korean hackers, according to the firms tracking the funds.

TRM said it had assessed with “high confidence” that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group.

According to the Council on Foreign Relations (CFR), the Lazarus Group “targets and compromises entities primarily in South Korea and South Korean interests for espionage, disruption, and destruction”.

It also conducts cyberoperations for financial gain, including targeting cryptocurrency exchanges, the CFR says.

The US Department of the Treasury sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea’s primary intelligence bureau. North Korea routinely denies involvement in hacking.

Chainalysis reached the same conclusion, however.

The FBI also blamed the Bybit hack in 2025 on the same unit.

TRM said the attackers ordered Binance’s wallets to empty into wallets they controlled, mirroring the Bybit hack.

Binance has been more cautious, however. “Our investigation has not attributed responsibility to any individual,” co-CEO Richard Teng said on X.

The company initially said the breach may have started with a hacked laptop belonging to one of its engineers. But on Friday, it said further investigation had uncovered “additional points of breach”.

Binance said it had found no evidence that any wallet’s private key, the digital password that controls a crypto wallet, had been leaked.

But Mark Karpeles, former head of the collapsed Tokyo exchange Mt Gox, told Reuters the attackers had probably accessed keys for at least two Binance wallets.

What was the purpose of the attack?

Money.

While North Korea denies involvement in crypto theft, it has become a much-needed source of foreign currency for Pyongyang, helping to prop up its economy and fund its nuclear programme, which is under United Nations sanctions, experts say.

In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about 1.5 trillion won ($1.1bn) in crypto and other virtual assets over five years.

“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” Ari Redbord, TRM’s global head of policy, told Al Jazeera, adding, “That makes this a global security issue, not just a crypto theft.”

What does this mean for the crypto market?

Prices have fallen, though markets steadied after the initial shock.

Bitcoin hit a six-week low of $76,368, while Ether fell more than 3 percent to a two-month low of $2,178.

Shares in crypto exchange Coinbase, which said it was unaffected, fell 4.8 percent.

The hack comes as crypto had already been under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers, analysts told Reuters.

The stolen sum is more than six times Binance’s $1bn emergency fund, the Secure Asset Fund for Users, set up in 2018 and held entirely in Bitcoin to protect users in case of a breach.

Teng said company funds would also cover losses.

Is crypto an inherently unsafe investment?

The hack has exposed one particular weak point: Large, centralised exchanges, which hold users’ assets on their behalf.

“Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes,” Sean Foley, an expert in crypto markets at Macquarie University in Sydney, told Al Jazeera.

Insurance offers limited protection as most crime- and cyber-insurance policies do not cover stolen cryptocurrency, and crypto-specific cover remains a niche business offered largely by specialist insurers.

Thefts are frequent. Hackers stole $2.87bn in crypto in nearly 150 attacks in 2025, according to TRM’s 2026 Crypto Crime Report.

Binance itself has faced legal trouble. Founder Changpeng Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform. US President Donald Trump pardoned him in 2025.

On Friday, Binance said it was coordinating with law enforcement and remained on track to resume withdrawals within 45 hours.