OMM Newsroom
About $6.3 billion worth of digital assets was stolen from cryptocurrency exchange Binance. The incident has shaken confidence in one of the world’s largest cryptocurrency platforms and prompted a market sell-off. Analysts in the United States suspect North Korea may have been behind the attack, AnewZ reports.
The theft is considered the largest in cryptocurrency history and has raised questions about the security of digital assets. Cryptocurrencies such as Bitcoin exist entirely in digital form and can be bought, sold, invested in and transferred across borders without relying on the banking system.
The cryptocurrency sector, which emerged as an alternative to traditional finance, has become a global industry attracting individual investors, major financial institutions and businesses. The latest attack, however, has shown that assets worth billions of dollars can be stolen without a bank vault being opened.
Attack lasted 20 minutes
US blockchain analytics firms TRM Labs and Chainalysis said the attack took place late Thursday and lasted just 20 minutes. Both firms expressed high confidence that North Korea was responsible, citing similarities to previous major cryptocurrency thefts.
TRM Labs said hackers moved digital assets out of Binance wallets and into accounts they controlled. The methods used were similar to those in the 2025 attack on cryptocurrency exchange Bybit, which the FBI attributed to North Korea.
Pyongyang has long been accused of using state-linked hacking groups to steal money and gather intelligence. North Korea has repeatedly denied the allegations. North Korean diplomatic missions in Geneva and China did not immediately respond to a request for comment from Reuters.
Some stolen funds frozen
Binance is taking steps to recover the stolen funds and reassure customers that their money is safe. The exchange said about $3 billion had been traced or frozen, with several major cryptocurrency companies joining efforts to prevent further transfers.
Tether blocked about $1.57 billion, Circle more than $800 million and Ripple about $200 million. World Liberty Financial worked with custodian BitGo to freeze additional assets. Binance co-founder Yi He said a further $27 million in stablecoins and about $2 million in World Liberty tokens had been frozen.
Recovering stolen funds may be more difficult than stopping them from moving. Cryptocurrency transactions recorded on a blockchain generally cannot be reversed like traditional bank transfers. Once assets have been moved, tracing and recovering them may require the involvement of several companies and jurisdictions.
Binance co-CEO Richard Teng pledged that customers would not bear the losses. The exchange said it would cover them through its SAFU fund, which is intended to protect users, and other company funds. Binance expects withdrawals to resume within 48 hours, but the identity of the attacker has not yet been established.
Binance’s initial investigation suggested the incident may have involved the compromise of a DevOps engineer’s laptop. This may have enabled the attacker to access a service container and submit unauthorized withdrawal requests. The exchange said it had found no evidence that wallet private keys had been leaked and would publish a technical report after the investigation is complete and the facts are verified.
Binance said deposits and withdrawals were temporarily suspended while it responded to the incident, permissions for the affected address were revoked, and work began with law enforcement and blockchain analysts to trace and recover the funds. The exchange also said it would publish an updated proof-of-reserves report.
Mark Karpeles, the former head of collapsed cryptocurrency exchange Mt. Gox, said hackers may have obtained private keys controlling at least two Binance wallets. Private keys are digital information used to access and transfer cryptocurrency assets. Karpeles said Binance appeared to have distributed its assets across several systems to limit potential damage.
Binance’s 2025 annual report said the exchange had 335 million registered users worldwide and held about $162.8 billion in assets. A $1 billion fund, held entirely in bitcoin and established to protect customers, is intended to cover losses arising from security incidents. The $6.3 billion theft is more than six times the size of that reserve.
Cryptocurrency prices fall
After the incident, bitcoin fell to $76,368, its lowest level in six weeks. Ether dropped more than 3% to $2,178, its lowest point in two months, before prices steadied. Binance Coin, now known as BNB, lost 5% in 24 hours to $709.70, according to CoinGecko.
The losses extended beyond digital currencies. Shares in US cryptocurrency exchange Coinbase, which said it was not affected by the attack, fell 4.8%, while shares in bitcoin investor Strategy declined about 6% in after-hours US trading.
The sell-off added to pressure on cryptocurrencies amid rising US interest rates and waning investor interest in exchange-traded funds. Binance’s preliminary investigation indicated that the incident may have involved the compromise of an engineer’s laptop, access to an internal system and unauthorized withdrawal requests. The company said it would cover all losses through its SAFU fund and its own funds, and that user assets were safe.
About $2.9 billion was stolen in roughly 150 cryptocurrency attacks in 2025, according to TRM Labs. More recently, exchange Bitget disclosed that about $350 million had been stolen in September.
Tim Sun, chief researcher at Hong Kong-based HashKey Group, said the attack on Binance could make investors more cautious and prompt them to reconsider whether large exchanges are safe places to hold assets. The central question now is not only whether Binance can recover the stolen funds, but whether cryptocurrency exchanges can convince customers that their digital wealth is secure.
