Cryptocurrency exchange Binance has disclosed that it is investigating a “complex attack” involving an estimated $6.3 billion in funds, with approximately $3 billion frozen to prevent further losses.
The company, the world’s largest cryptocurrency exchange by daily trading volume, said investigations had uncovered additional security breaches, contradicting its initial assessment that the incident originated from a single compromised laptop.
“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance said in a statement posted on X on Friday.
The exchange had earlier issued a series of updates, at times appearing contradictory, assuring users that their funds were safe while pledging to cover all losses resulting from the incident.
Binance’s Latin America X account confirmed that the estimated financial impact of the attack stood at approximately $6.3 billion.
The figure is significantly higher than the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, previously regarded as the largest cryptocurrency theft of its kind.
Binance warned that the estimated losses could increase as its investigators work with law enforcement agencies, cryptocurrency issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.
The exchange said approximately $3 billion in affected funds had already been frozen.
The 2025 Bybit attack was attributed to TraderTraitor, a hacking group linked to North Korea.
Blockchain intelligence firm TRM Labs said on Thursday that it had “high confidence” that the latest Binance attack was also orchestrated by TraderTraitor, citing what it described as “robust on and off-chain intelligence”.
“Several features of this attack match earlier North Korea-linked heists,” the firm said.
TraderTraitor is believed to be associated with the Lazarus Group, a North Korean hacking organisation that gained international notoriety in 2014 after being accused of attacking Sony Pictures over the release of The Interview, a comedy film depicting North Korean leader Kim Jong Un.
Binance suspends withdrawals
Binance temporarily suspended deposits and withdrawals following the discovery of the security breach as investigations continued.
However, at about 9:00 GMT on Friday, the company said it was on course to resume withdrawals within 45 hours, while confirming that deposits remained unaffected.
In its initial explanation of the incident, Binance said preliminary investigations suggested that hackers had gained access through a compromised laptop belonging to a DevOps engineer.
The breach allegedly allowed an unauthorised individual to access a service container and execute fraudulent withdrawal transactions.
The exchange said it had found no evidence that private keys associated with its wallets had been compromised.
It also promised to release a detailed technical report after investigations had been concluded.
However, the company subsequently disclosed that further investigations had uncovered additional points of breach, suggesting that the attack was more extensive than initially believed.
Meanwhile, major cryptocurrency issuers have taken steps to freeze funds allegedly connected to the incident.
Paolo Ardoino, Chief Executive Officer of Tether, which issues the USDT stablecoin, said his company had frozen approximately $1.6 billion linked to a potential Binance exchange hack.
Similarly, Jeremy Allaire, head of cryptocurrency platform Circle, disclosed that his company had frozen more than $800 million in USDC.
USDT and USDC are stablecoins designed to maintain a relatively stable value by being pegged to traditional currencies, particularly the US dollar.
The United States Department of Justice and the Federal Bureau of Investigation had not immediately responded to requests for comments on the incident.
Cryptocurrency prices tumble
Reports of the cyberattack triggered declines across major cryptocurrency markets, with several digital assets losing value as investors reacted to the news.
Before Binance publicly confirmed the incident, industry observers had reported that hackers might have gained access to the platform.
Bitcoin and Ethereum fell by nearly five per cent and six per cent, respectively, while BNB, Binance’s native cryptocurrency, dropped by almost 10 per cent.
Stablecoins largely avoided the declines because their values are designed to remain pegged to traditional currencies.
The incident comes amid growing concerns among industry observers about the security implications of increasingly sophisticated artificial intelligence technologies.
Some experts have warned that advances in AI could create new vulnerabilities for cryptographic systems and existing information technology security protocols, potentially exposing cryptocurrency platforms and other digital financial services to more sophisticated cyberattacks.
