Binance links $6.3 billion crypto breach to engineer’s compromised laptop, North Korea suspected

New Delhi: Binance, the world’s largest cryptocurrency exchange, has reported a security breach involving an estimated $6.3 billion in digital assets. The incident has raised concerns about the security of cryptocurrency platforms and triggered a decline in prices across the market.

US blockchain analysis firms TRM Labs and Chainalysis have expressed high confidence that North Korea was behind the attack. Both firms linked the incident to earlier cyber thefts attributed to Pyongyang. However, Binance has not confirmed the identity of those responsible.

In a security update published on Friday, Binance said its initial investigation pointed to a potentially compromised laptop belonging to a DevOps engineer. The attacker allegedly used access gained through the laptop to enter a service container and submit unauthorized withdrawal transactions.

A service container is a software environment used to run specific applications or functions. Binance said it had found no evidence that private keys used to access its cryptocurrency wallets had been leaked. The exchange added that it would publish a detailed technical report after completing its investigation.

Binance estimated the total financial impact at around $6.3 billion. It said it had worked with blockchain partners to freeze affected assets, with approximately $3 billion already frozen on the blockchain.

The exchange also assured customers that they would not suffer any financial losses. It said all losses would be covered through its secure asset fund for users (Safu) and company funds. Binance further announced plans to publish an updated proof of reserves after completing the recovery and security measures. Proof of reserves is a system used by cryptocurrency exchanges to demonstrate that they hold sufficient assets to cover customer balances.

As part of its immediate response, Binance temporarily suspended deposits and withdrawals while carrying out security checks. It also revoked authorization for the affected address and contacted law enforcement agencies and blockchain intelligence firms to trace and recover the stolen funds.

The recovery effort has also involved other cryptocurrency companies. Stablecoin issuers Tether and Circle froze nearly $1.57 billion and more than $800 million in assets linked to the incident, respectively. According to report, World Liberty Financial and Ripple also reported freezing funds associated with the breach.

The attack has affected cryptocurrency markets, with Bitcoin falling to a six-week low of $76,368 and Ether declining to $2,178, its lowest level in two months. Binance’s BNB token also fell around 5 per cent over 24 hours to $709.70. Shares of cryptocurrency exchange Coinbase dropped 4.8 per cent, while those of Bitcoin investment firm Strategy fell nearly 6 per cent in extended US trading.

The scale of the breach has drawn attention to the security risks facing centralized cryptocurrency exchanges. These platforms hold and manage digital assets on behalf of customers, making their internal systems potential targets for cybercriminals.

Binance reported 335 million registered users worldwide and approximately $162.8 billion in assets under custody in its 2025 annual report. Its $1 billion Safu reserve is designed to protect users during emergencies involving security breaches. The estimated impact of the latest incident is considerably higher than the fund’s stated value.

The incident adds to a series of major cryptocurrency thefts. According to TRM Labs, hackers stole approximately $2.9 billion in digital assets across nearly 150 attacks last year. In September, cryptocurrency exchange Bitget also reported a theft of around $350 million from its platform.