Binance hack is a wake-up call for the public
The attack was the biggest crypto heist in history.
The multibillion crypto hack of Binance is a "wake-up call for the wider public", one Irish cybersecurity expert has said.
Hackers stole $6.3bn from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would cover the losses. About half the stolen assets were quickly frozen by stablecoin issuers such as Tether, Circle and the Trump-backed World Liberty Financial.
"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," Binance said in a post on X.
The exchange said customer funds were safe and that it was working with partners to freeze some of the affected assets, with about $3bn located so far. It expects to resume withdrawal services in the next 45 hours. It did not mention the status of the remaining $3.3bn.
Binance runs a secure asset fund for users, a $1bn bitcoin reserve designed to protect customer assets in the event of security breaches, according to its website.
Co-CEO Teng said that "and company funds" would cover losses.
The bulk of the heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korea.
"TRM attributes the attack to ... North Korea’s elite hacking unit," the firm said in an analysis of the hack posted to its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.
North Korea routinely denies that. Its mission in Geneva and embassy in China did not immediately respond to Reuters' requests for comment.
"Your money is safe and we're covering every loss," Teng said on X. "Our investigation has not attributed responsibility to any individual."
Rob McCardle, Director of Cybercrime Research at TrendAI, said: "This attack is a wake-up call for the wider public about a trend that is well understood within the cybersecurity industry: the scale and speed of cyber attacks have reached a level where they can cause devastating losses, even for the largest and best-defended organisations."
"Based on the limited technical details available, the attacker appears to have compromised a single employee, obtained unauthorised permissions to operate a specific system and then abused its legitimate functionality," he said.
Mr McCardle said organisations looking to defend against modern attacks need to stop looking at what worked six months ago, and think what they will need in six months. "They should leverage their knowledge of exponential change from the pandemic, to understand the scale of attack volume changes that are coming, and put in place systems and processes that can respond at that speed," he said.
"This highlights the importance of not only protecting against initial access, but also continuously monitoring systems on the assumption that any employee could be compromised at any time, and putting appropriate security measures in place."
Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178 before markets stabilised.
BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 5% over the past 24 hours at $709.70, according to CoinGecko, while shaky confidence hit listed crypto exchange shares.
Shares in crypto exchange Coinbase Global COIN.O, which said it was unaffected, slid 4.8%, while those of bitcoin buyer Strategy MSTR.O fell nearly 6% in extended US trading.
An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said.
"Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident," Binance said. Later, the company added it had uncovered additional points of breach.
Mark Karpeles, former chief of defunct Tokyo-based bitcoin exchange Mt Gox, which collapsed a dozen years ago after $500m in bitcoin was stolen, said attackers probably accessed private keys for at least two Binance wallets.
"Binance appears to have split its assets across multiple systems, ensuring a hack can only affect a part of the assets, but even so a single hack is a large loss," he said.
Beyond the potential loss of assets, the security breach was likely to have wider ramifications for the crypto sector, which had already been under pressure due to higher US interest rates and softer demand from exchange-traded fund buyers, analysts said.
"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges," said Tim Sun, senior researcher at HashKey Group, based in Hong Kong.
Binance, which allows users to buy, sell and trade digital assets, has 335m registered users globally and had about $162.8bn in assets under custody as of its 2025 annual report.
Stablecoin issuer Tether said it had frozen nearly $1.57bn in assets linked to the incident, while Circle froze more than $800m.
World Liberty Financial said it worked with custodian BitGo to freeze funds, and Binance co-founder Yi He said $27m in stablecoins and about $2m worth of World Liberty tokens had been frozen. Crypto firm Ripple also froze roughly $200m in funds, Yi said.
The incident adds to a string of crypto thefts. Last year, attackers stole $2.9bn worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
In September, Bitget said roughly $350m in crypto had been stolen from its platform, underscoring the industry's vulnerability to hackers.
"The broader credit and industry implications will depend on the ultimate losses, affected counterparties, asset recovery, and importantly, whether the incident leads to wider disruption or loss of confidence across the digital-asset ecosystem," said Cristiano Ventricelli, vice president, digital assets at Moody’s Ratings.
Reuters
CONNECT WITH US TODAY
Be the first to know the latest news and updates
