• Blockchain analysts blame North Korean hackers for ‘largest financial heist of all time’; attackers siphon billions in about 20 minutes.
• Exchange halts withdrawals, pledges company funds to cover losses
• FBI, Secret Service join the probe as Abu Dhabi regulator monitors fallout
SINGAPORE: Hackers stole $6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in an attack late on Thursday that blockchain analysts blamed on North Korea and described as potentially the largest financial heist of all time.
The bulk of the theft unfolded in about 20 minutes, when attackers manipulated a transaction approval system to move money from a Binance-controlled, internet-connected wallet without passing through normal controls, the exchange said Friday.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would use company funds to cover the losses. The exchange said customer funds were safe and it expected to resume withdrawals within 48 hours.
Stablecoin issuers, including Tether and Trump-backed World Liberty Financial, froze about half the stolen assets.
Tether said it had frozen nearly $1.57bn, while Circle froze more than $800m. Binance said it was working with partners to freeze affected assets, with about $3bn located so far. It did not mention the status of the remaining $3.3bn.
Binance said it had set aside about $6.34bn of company funds internally to cover the losses. Founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than $1bn. The company also has a $1bn bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website.
“We NEVER use any customer funds, so they are not impacted,” Binance co-CEO Richard Teng said on X.
Teng described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete traces of its activity, making the investigation more difficult. He said it was not carried out by one person.
US blockchain analysis firms TRM Labs and Chainalysis said the attack bore similarities to previous large thefts blamed on North Korea. Both said they were highly confident North Korea was responsible.
TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 theft at crypto exchange Bybit that the FBI attributed to North Korea.
“This incident is almost certainly the single largest known theft of any kind,” British blockchain analysts Elliptic said.
North Korea has for years used state-linked cyber units for espionage and financial theft, according to US and South Korean authorities and cybersecurity experts. North Korea routinely denies such allegations. Its diplomatic missions in Geneva and China did not respond to requests for comment.
Binance is working with the FBI and US Secret Service, a person familiar with the situation told Reuters. The FBI said it was “aware of the incident” and coordinating with public and private partners. The Secret Service did not respond to a request for comment.
Abu Dhabi’s Financial Services Regulatory Authority, which issued Binance’s main operating licence, said it was closely monitoring the incident.
The theft rattled cryptocurrency markets. Bitcoin hit a six-week low of $76,368, while ether fell more than 3pc to a two-month low of $2,178 before markets stabilised. BNB, a token originally launched as Binance Coin, fell 6.2pc over 24 hours to $702, according to CoinMarketCap.
Shares of listed cryptocurrency exchanges also suffered.
Last year, attackers stole $2.9bn worth of cryptocurrency in nearly 150 attacks, according to researchers at TRM Labs.
The breach could further undermine confidence in centralised exchanges, analysts said, as the sector faces higher US interest rates and softer demand from exchange-traded fund buyers.
Binance has 335 million registered users worldwide and held about $162.8bn in assets under custody.
Published in Dawn, October 31st, 2026
