Binance hack: $6.3bn stolen, losses covered, who is suspected

Binance, the largest crypto exchange by trading volume, has been hit by what is believed to be the biggest crypto hack ever, at $6.3bn (£4.7bn). Co-chief executive Richard Teng said the company is working with the authorities to establish what happened and will cover all losses. The exchange says it has begun recovering crypto funds. Binance was founded in China in 2017 and reports hundreds of millions of registered users worldwide. In 2024 it said it held more than $160bn in assets.

The attack hit Binance's global centralised exchange, Binance.com. Binance.us, the platform that serves US residents, said it was not affected. In an initial announcement, Teng said the first investigation pointed to a compromised laptop belonging to a DevOps engineer. That, he said, gave an attacker access to a service container, where unauthorised withdrawal transactions were submitted. Teng described the operation as not a simple one-click action but a more complex attack process. He later said more than one person was involved and that the hackers used methods to hide their tracks, including a self-destruct mechanism.

Raghu Nandakumara, vice president of industry strategy at the cybersecurity platform Illumio, said the engineer may have been persuaded to run a test, with malware landing on the laptop during it. Because that machine already carried enough security privileges, early reports suggest it became the attacker's route into production systems and from there to the wallets. Dr Clive Summerfield, who heads FARx, a biometrics company working on AI security, put the same point plainly: strong mathematical defences do not help if the person holding the keys can be tricked.

Nobody has been publicly identified as responsible. Some analytics firms have pointed to North Korea, a link that remains unconfirmed. The AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resembled earlier incidents tied to the territory, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025. Those earlier attacks have been linked to a group of cyber-criminals accused of working directly for the regime, known as the Lazarus Group or TraderTraitor.

Dr Edward Howell, a North Korean foreign policy expert at the University of Oxford, told the BBC that Pyongyang has long used cyber warfare to extract cash. He said North Korea effectively runs a state cyber warfare agency, used to fund its weapons of mass destruction programmes and as a slush fund for Kim Jong Un's regime. Howell added that, as of now, roughly 40 to 50% of those weapons programmes are funded through cyber and crypto-currency operations. That is his assessment, not a finding attributed to Binance or to investigators.