Binance, the world’s largest cryptocurrency exchange, says hackers have stolen about $6.3bn in what appears to have been the biggest crypto heist on record. The company, which was co-founded by the Chinese-born Canadian billionaire Changpeng Zhao, suspended deposits and withdrawals on Thursday and said it would cover all losses, telling Al Jazeera in a statement that user funds were “safe”. Two United States blockchain analysis firms have claimed the attack originated in North Korea.
So how did it happen, and what does it mean for the crypto market? Here’s what you need to know: Blockchain analysis firms TRM Labs and Chainalysis say most of the theft unfolded over about 20 minutes, starting late on Thursday. That dwarfs the previous record of $1.5bn, which was stolen from the exchange Bybit in February 2025.
Binance said about $3bn of that has since been frozen, including more than $2.3bn by stablecoin issuers Tether and Circle, according to the news agency. Binance has not stated what has happened to the remaining $3.3bn. It also warned on X that the $6.3bn figure “may continue to increase” as the company works to trace and freeze more assets.
North Korean hackers, according to the firms tracking the funds. TRM said it had assessed with “high confidence” that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. According to the Council on Foreign Relations (CFR), the Lazarus Group “targets and compromises entities primarily in South Korea and South Korean interests for espionage, disruption, and destruction”.
It also conducts cyberoperations for financial gain, including targeting cryptocurrency exchanges, the CFR says. The US Department of the Treasury sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea’s primary intelligence bureau. North Korea routinely denies involvement in hacking.
Chainalysis reached the same conclusion, however. The FBI also blamed the Bybit hack in 2025 on the same unit. TRM said the attackers ordered Binance’s wallets to empty into wallets they controlled, mirroring the Bybit hack.
Extract — continue reading at the source.
