Binance has managed to freeze around US$3 billion (RM12.7 billion) of the US$6.3 billion (RM26.7 billion) in digital assets stolen in what is believed to be the largest cryptocurrency heist on record.
The world’s largest cryptocurrency exchange said the recovered funds had been secured, but the remaining assets were still believed to be in the hands of unidentified hackers.
The company initially suspected that a compromised laptop belonging to an engineer had enabled the attackers to make unauthorised withdrawals. However, further investigations revealed that the breach was more extensive than first thought.
Binance co-CEO Richard Teng said the attack was not the work of a single individual and involved multiple points of breach.
He also revealed that the hackers had deployed a “self-destruct mechanism” to destroy their tools and traces as they carried out the attack, making it harder for investigators to track their activities.
Several cryptocurrency analytics firms have linked the incident to a North Korean hacking unit. The suspected heist is significantly larger than the US$1.5 billion (RM6.35 billion) stolen from cryptocurrency exchange Bybit in 2025.
The US Secret Service said it was working around the clock to identify, freeze, trace and recover the stolen funds.
The agency also pledged to identify those responsible and bring them to justice. Binance confirmed that it was cooperating with the FBI as investigations continued.
Although Binance said its US-facing exchange was not affected, American authorities could still investigate the incident and assist in tracing the stolen assets through international law enforcement cooperation.
The attack also involved assets linked to the US, including Tether and Circle, which issue stablecoins pegged to the US dollar.
Binance sought to reassure customers, saying: “Your money is safe, and we’re covering every loss.”
The exchange initially suspended deposits and withdrawals but later clarified that deposits remained unaffected.
In a subsequent update, Binance said it had set aside more than US$6.34 billion in company funds to cover the stolen assets and was actively purchasing various cryptocurrency tokens.
The incident rattled cryptocurrency markets on Friday, with Bitcoin falling 5% to US$76,800 during afternoon trading in New York.
Coinbase shares also dropped 12%, partly as investors reacted to its earnings report, which showed revenue slightly below expectations. Robinhood, a financial services company that also trades in cryptocurrency, fell 7.8%.
Founded in China in 2017, Binance allows users to trade digital assets and has more than 300 million registered users worldwide. The company said in 2024 that it held more than US$160 billion in assets under custody.
Despite its assurances, the scale of the breach has raised concerns over whether Binance can absorb the losses and fulfil its promise to protect customers’ funds.
Some cryptocurrency observers have drawn comparisons with the collapse of FTX in 2022, recalling how its former chief executive, Sam Bankman-Fried, had also reassured customers before the exchange collapsed, leaving them facing huge losses.
Legal experts have also warned customers against assuming Binance’s promise to cover the losses is legally binding.
Daniel Tunkel, of London-based law firm Edwin Coe, said any potential claims would depend on the terms of customers’ contracts and whether Binance could be sued for failing to fulfil its obligations.
The exchange has also faced regulatory scrutiny in various countries.
Meanwhile, AI-powered investigations firm TRM Labs said several aspects of the attack resembled previous incidents linked to North Korean hackers, including the Bybit breach.
The cryptocurrency industry has suffered massive losses from cyberattacks over the past five years, with investigators frequently pointing to North Korean-linked groups, including the notorious Lazarus Group, also known as TraderTraitor.
Cryptocurrency analytics firm Chainalysis said it had “high confidence” that a North Korean actor was linked to the latest hack.
North Korea, which faces extensive international sanctions and has limited industrial activity, has repeatedly been accused by experts of using cybercrime to generate revenue for the regime.
Pyongyang has consistently denied the allegations, but investigators have cited cryptocurrency transaction tracking and interviews with defectors as evidence linking the country to such operations.
