Global cryptocurrency exchange Binance is reeling from a massive cyberattack that resulted in the theft of $6.3 billion. The incident, described as the largest digital asset heist in history, has prompted a frantic effort to recover the stolen funds. According to Binance, roughly half of the missing digital assets – approximately $3 billion – have been located and frozen through rapid coordination across multiple blockchain platforms and private-sector partners.
The theft unfolded rapidly within a 20-minute window, with funds moved across ten distinct blockchain networks starting around 4 p.m. ET Thursday. Binance co-CEO Richard Teng explained the operational reality of the breach during public updates, clarifying the technical scope of the incident. The attack involved a complex process, with the perpetrators employing a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for Binance to trace and investigate.
Initial assessments pointed to a compromised laptop belonging to a DevOps engineer, but subsequent internal analysis revealed a far broader infrastructure intrusion. Teng sought to clarify the mechanics of the intrusion, stating that the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. The investigation has not attributed responsibility to any individual, and so far, there is no evidence of any wallet private key leak.
To contain further movement of assets, Binance temporarily halted platform withdrawals while keeping deposit infrastructure active. The company has set aside $5 billion to cover losses and is purchasing an additional $1.34 billion in cryptocurrencies to meet the full stolen total. Company executives moved quickly to reassure global customers regarding account balances and operational continuity.
Multiple blockchain analytics firms have tied the operational signatures of the heist directly to North Korean state-sponsored cyber units. AI-powered blockchain security firm TRM Labs noted clear technical similarities between this exploit and previous high-profile incidents attributed to Pyongyang's network operation. This has raised concerns about the involvement of state-sponsored threat groups in the cyberattack.
The incident eclipses a previous record $1.5 billion breach targeting the Bybit exchange in 2025. Binance executives have moved to reassure customers that their assets are safe and that the company is covering every loss. Teng reinforced this stance in a video address to exchange users, stating that customer funds are not impacted.
The Ghana-based cryptocurrency exchange is working to recover the stolen funds and prevent similar incidents in the future. The incident highlights the need for robust security measures in the cryptocurrency industry. Key Points:
Key points
- Binance recovers roughly half of $6.3 billion stolen in cyberattack
- Attack attributed to North Korean state-sponsored cyber units
- Incident is largest digital asset heist in history
