Binance Loses $6.3 Billion in Record Crypto Heist Tied to North Korea

Binance, the world's largest cryptocurrency exchange, confirmed Thursday that attackers made off with $6.3 billion in digital assets, in what blockchain investigators are calling the largest crypto heist on record. The company says it will cover all customer losses and has temporarily halted deposits and withdrawals while it investigates.

By early Friday, Binance said it had managed to freeze roughly $3 billion of the stolen funds, a little under half the total.

The scale and speed of the theft are what set it apart. According to Binance, the attackers pulled assets worth about $6.36 billion out of the exchange's wallets in roughly 20 minutes, spreading the funds across 20 different blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana. Moving stolen crypto across that many chains simultaneously is a technique that makes tracing and recovery significantly harder, since investigators and exchanges have to chase the money through separate ecosystems at once rather than following a single trail.

Binance's early account of how the breach happened centers on a single compromised laptop. In its initial investigation, the company said the intrusion "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." DevOps engineers typically have elevated access to a company's internal systems to manage software deployment, which can make their devices high-value targets.

Binance was careful to note that it has found "no evidence of any wallet private key leak," suggesting the breach exploited an operational access point rather than cryptographic keys that directly control the funds. The company said it will "share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."

Fingers point to North Korea

Two blockchain analytics firms, Chainalysis and TRM Labs, both said they have a high degree of confidence that North Korean hackers carried out the attack, and both said they are actively tracking where the stolen funds are moving. North Korean state-linked hacking groups have a long track record of targeting crypto exchanges as a way to generate revenue for the regime, and the scale here would make it one of the largest such operations yet attributed to them.

The reserves question

The hack also raises a test of Binance's "proof of reserves" system, a regular disclosure the exchange publishes to show its wallets hold enough assets to match every customer's balance. Its most recent snapshot before the hack showed reserves above 100% across listed assets, meaning customer funds were fully backed at the time.

Binance said the hackers are believed to have hit some of those reserve wallets directly. To close the gap, the company says it will draw on emergency funds and its own money rather than leave customer balances short. Binance has committed to publishing an updated proof-of-reserves snapshot "once the remediation is complete," which will be the real-world check on whether that promise holds up.

For now, the exchange's priority is containment: freezing what it can, keeping deposits and withdrawals paused, and working with investigators to trace a theft that moved faster and across more chains than almost anything seen before in crypto. The next marker to watch is Binance's promised technical post-mortem, which should spell out exactly how a single engineer's laptop turned into a $6.3 billion breach.