BOSTON/SINGAPORE/PARIS (Reuters) - Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a theft that analysts blamed on North Korea and said could be the largest financial heist of all time.
Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would use company funds to cover the losses. Stablecoin issuers including El Salvador-based Tether and the Trump-backed World Liberty Financial froze about half of the stolen assets.
The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about $3 billion located so far. It said earlier on Friday it expected to resume withdrawal services in the next 48 hours. It did not mention the status of the remaining $3.3 billion, but Binance co-CEO Yi He said in a post on X that $3 billion represented only about 2% of the company's total user assets and public reserves.
Binance said it had set aside around $6.34 billion of company funds internally to cover the losses. The company has a $1 billion bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website. Binance founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than $1 billion.
Binance other co-CEO, Richard Teng, said in a post on X that the breach as a "complex attack" that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete evidence of its activity as it went along, "making it more difficult for us to trace and investigate."
The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected so-called "hot" wallet in a way that did not pass through normal approval controls, Teng said.
"Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust," Teng wrote.
'LARGEST KNOWN THEFT'
The incident adds to a string of crypto thefts. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
"This incident is almost certainly the single largest known theft of any kind," British blockchain analysts Elliptic said.
The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts. North Korea routinely denies that. Its mission in Geneva and embassy in China did not respond to requests for comment.
"When North Korea steals at this scale, the money supports weapons proliferation, which makes this a national security issue, not just a crypto theft," Ari Redbord, global head of policy and government affairs at TRM, said.
Binance is working with the Federal Bureau of Investigation and the United States Secret Service (USSS), a person familiar with the situation told Reuters.
The FBI said it was "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps."
The USSS said in a statement that its investigators "are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace, and recover funds stolen from Binance on Thursday."
Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.
Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, said it was "engaging closely with Binance and monitoring the incident". Abu Dhabi-backed investment group MGX declined to comment. It became a minority investor in Binance last year.
Crypto prices fell broadly but losses were contained.
Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178 before markets stabilised. Bitcoin last stood at $77,355 and ether at $2,229. Binance's BNB token was down 6.74% over the past 24 hours at $698.
SECURITY IMPLICATIONS
Beyond the potential loss of assets, the security breach was likely to have wider ramifications for the crypto sector, which had already been under pressure due to higher US interest rates and softer demand from exchange-traded fund buyers, analysts said.
"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges," said Tim Sun, senior researcher at HashKey Group.
Investor Michael Saylor, among Bitcoin's most prominent supporters, said in a post on X that he expected Binance to "deliver" on ensuring no customers suffered losses. "Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient," he wrote on Friday.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report.