Crypto exchange Binance hacked: Biggest hack in history at $6.3bn? What went wrong? What initial investigations suggest?
Hackers have stolen an estimated $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts have described as potentially the biggest financial heist in history, Reuters reported.
The massive breach triggered a sell-off in cryptocurrency markets, prompting Binance to temporarily suspend withdrawals as it moved to contain the damage.
The exchange said it would use its own funds to cover the losses and assured customers that their assets remained safe.
Quick answers to key questions
•5 QUESTIONS
1
What happened in the Binance hack?⌵Binance reported a security breach involving an estimated $6.3 billion in cryptocurrency assets. The incident led the exchange to temporarily suspend withdrawals while it investigated and secured its systems.
2
How did hackers breach Binance?⌵An initial investigation suggested the breach may have begun with a hacked laptop belonging to one of Binance’s engineers, which could have helped an attacker access a system and make unauthorised withdrawals. Investigators were still examining how the attackers gained access.
3
How much of the stolen Binance funds has been located?⌵Binance said it had located around $3 billion of the affected funds. Stablecoin issuers and other partners froze some assets linked to the incident.
4
Why did Binance suspend withdrawals after the hack?⌵Binance suspended withdrawals as a precaution while its security teams checked the platform, secured its wallet infrastructure and traced affected assets. The exchange said services would resume once its security environment was considered safe.
5
Who is suspected of carrying out the Binance hack?⌵Blockchain analytics firm Chainalysis said it had high confidence that a North Korea-linked hacking group was involved. The attribution has not been confirmed, and the investigation is ongoing.
The incident has also drawn attention to North Korea-linked hacking groups, with blockchain analytics firm Chainalysis expressing "high confidence" that operatives linked to Pyongyang were behind the attack, according to the BBC.
Binance said it was coordinating with law enforcement agencies, including the US Federal Bureau of Investigation (FBI) and the US Secret Service (USSS), to investigate the breach.
"This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," the company said in a post on X.
The attack resulted in the theft of approximately $6.3 billion in cryptocurrency assets, making it one of the largest reported breaches involving a digital asset platform.
Binance said it had identified and located around $3 billion of the stolen funds so far, with stablecoin issuers stepping in to freeze a substantial portion of the affected assets.
Among those involved were El Salvador-based Tether and Trump-backed World Liberty Financial, which froze assets linked to the incident.
The exchange initially suspended withdrawals, with co-CEO Yi He saying that services would remain disabled until the platform's security environment was confirmed to be safe.
Binance subsequently indicated that it expected withdrawal services to resume within 48 hours.
The company also said it had internally allocated approximately $6.34 billion to cover the losses, although it did not disclose the precise sources of these funds.
Binance maintains a $1 billion Bitcoin reserve fund, designed to provide protection to customers in the event of security breaches. Founder Changpeng Zhao also said on X that the company held SpaceX shares worth more than $1 billion.
Early investigations have pointed towards a possible North Korean connection.
Chainalysis said it had "high confidence" that a North Korea-linked hacking group was involved in the breach, the BBC reported.
North Korean-linked cyber operatives have increasingly targeted cryptocurrency exchanges and digital asset companies in recent years, stealing large amounts of virtual currencies.
Western intelligence and security agencies have previously warned that proceeds from such cyberattacks are used to finance Pyongyang's weapons programmes, including its nuclear and ballistic missile development, as per the BBC report.
However, investigators are still examining how the attackers gained access and moved the stolen funds.
In a separate update, Binance said its investigation had identified additional points of compromise.
"We are still gathering the facts, and will share more directly as we have them," the company said.
The attack has raised questions about whether cybercriminals are increasingly finding ways around conventional cryptocurrency security systems.
According to Dave from cybersecurity firm Check Point, the Binance incident bore similarities to an attack on cryptocurrency exchange Bitget in September, in which approximately $388 million was stolen, BBC reported.
The emerging concern is that hackers may no longer need direct access to cryptocurrency vault keys to execute large-scale thefts.
Instead, they could be targeting the systems, infrastructure and individuals authorised to access and transfer digital assets.
Binance said it was working with law enforcement agencies and cryptocurrency industry partners to trace and freeze the stolen funds, according to Reuters.
The exchange also thanked stablecoin issuers for their assistance in blocking transactions involving the affected assets.
Co-CEO Yi He said customer withdrawals would remain suspended until the platform's security environment was considered safe.
The company has maintained that customer funds are secure and that it has sufficient resources to absorb the financial impact of the breach.
Founded in 2017, Binance is the world's largest cryptocurrency exchange by trading volume and has more than 300 million registered users globally.
The company said in 2024 that it held more than $160 billion in assets under custody.
The scale of the reported theft raises fresh questions about the security of centralised cryptocurrency exchanges, which hold vast amounts of digital assets and remain attractive targets for sophisticated hacking groups.
Bhanu Pratap is a journalist who reports and writes on foreign affairs, India’s foreign policy, geopolitics and strategic affairs. He closely follows diplomatic developments in New Delhi and has a keen interest in defence and national security.<br> <br> Bhanu also focuses on in-depth, interview-based reports and regularly speaking with experts and policymakers to bring perspectives and context to major developments around the world.<br> <br> He is also interested in stories with strong humanitarian angles.<br><br> One such report examined the cases of Indian nationals who were allegedly recruited and forced into Russia’s war against Ukraine. While reporting the story, Bhanu spoke to the families of those affected and documented their experiences. The report was later taken into account by the United Nations in its findings on human rights violations linked to the war in Ukraine.<br> <br> For Bhanu, the zeal to produce meaningful and impactful journalism remains at the heart of his work.<br> <br>He has previously worked with Firstpost, NDTV, Newslaundry and Republic.<br><br> Bhanu studied at the Delhi School of Journalism, University of Delhi. He initially chose science with plans to pursue engineering, influenced by conventional expectations, but fate had other plans and eventually led him to journalism.<br><br> Beyond the newsroom, Bhanu enjoys exploring culture and history and often spends his days off on heritage walks. He is also passionate about travelling, biking and listening to folk music.<br> <br>For tips, reviews and suggestions, you can reach him at bhanu.pratap@htdigital.in.
Catch all the Business News , Corporate news , Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
More
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.