Image source, Getty Images

This latest hack targeting Binance is thought to be the largest in history and eclipses a previous attack on the Bybit exchange in 2025.

In the 2025 incident, hackers thought to be working for North Korea - in a network known as Lazarus Group - swiped $1.5bn (£1.1bn).

Within around two weeks of the attack, they had managed to successfully convert at least $300m into unrecoverable funds.

In a post on X in August this year - 18 months after the attack - Bybit co-founder Ben Zhou said the company had been "working on recovery from every possible angle" and had recovered around $48.4m, with another $30.5m "frozen".

He added that the exchange had also filed a civil lawsuit against North Korea and the Lazarus Group.

AI-powered investigations company TRM Labs has said that several elements of the latest Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.

Image source, Getty Images

Here's the full statement from Richard Teng, Binance's co-CEO:

"I want to speak to you directly about what happened. Bottom line - your money is safe, and we're covering every loss.

"Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.

"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.

"We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete.

"What you need to know:

• Your funds are safe
• Binance will cover all losses from the SAFU fund and company funds
• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
• No evidence of any wallet private key leak
• Deposits are unaffected and operating as normal

"What we've done:

• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
• Revoked the affected address authorizations
• Engaged law enforcement and blockchain intelligence partners to trace and recover funds

"Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can."

Richard Teng, the co-CEO of Binance, has just released a statement on X.

In it, he says the company's "initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop".

But, he goes on: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process."

We'll bring you his statement, in full, in our next post.

The identity of the hackers is unclear.

Binance says it is "working closely" with law enforcement to identify them and "bring them to justice".

It has not directly responded to BBC queries about the incident's potential links to North Korea.

It comes after two analytics firms attributed the incident to a North Korean hacking unit called TraderTraitor.

AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korean-linked incidents, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025.

Chainalysis, another crypto analytics firm, also said it has "high confidence" that the North Korean group are linked to the hack.

Image source, Reuters

Binance is the world's biggest cryptocurrency exchange.

Founded in China in 2017, it allows users to trade digital assets and has hundreds of millions registered users worldwide.

The hacking incident concerns Binance.com, a centralised exchange that offers users a range of financial products and services. Those include purchasing and trading a wide range of digital currencies, as well as digital wallets, futures, securities, savings accounts and even lending.

Binance.US, which provides trading services specifically for American residents - said its platform is not affected by the issue.

The exchange has been subject of regulatory scrutiny around the world.

In 2023, Binance chief executive Changpeng Zhao resigned after pleading guilty to money laundering violations.

Last year, a lawsuit in the US accused the company of helping send millions of dollars to US- designated terrorist organisations.

The company said in 2024 that it has more than $160bn in assets under custody.

This story is still developing, with crypto giant Binance saying it is working with law enforcement to confirm the identity of the criminals.

What we know

• How much was impacted: Binance says the hack involves $6.3bn (£4.7bn) of digital assets, with around half of those being frozen but many remaining in the hands of the hackers
• Assets have been frozen: Binance’s co-chief executive Yi He has said: "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure"
• Other platforms have taken precautions: Two other major platforms, Tether and Circle, have said they’ve frozen a total of about $2.4bn of assets
• Binance’s response: The firm says it will "cover all losses"

What we don’t know

• Who’s behind the hack: Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor, but Binance has not responded to the BBC’s queries about possible links to North Korea
• What it means for crypto investors: Bitcoin dropped by more than 4% following the alerts - but it is unclear whether security risks like this will impact longer-term sentiment towards it

Image source, Bloomberg via Getty Images

Cryptocurrency giant Binance has said that $6.3bn (£4.7bn) of digital assets have been impacted by what could be the largest hack in history.

The world's biggest crypto exchange says about half of those assets had been frozen but that many remained in the hands of the hackers, adding that it will "cover all losses".

Early checks show the incident may have involved an engineer's laptop that had been compromised, which allowed an attacker to make unauthorised withdrawals, Binance says.

Two analytics firms have attributed the incident, which eclipses a record-setting $1.5bn hack on the Bybit exchange in 2025, to a North Korean hacking unit called TraderTraitor.

Binance did not directly respond to BBC queries about the incident's potential links to North Korea but said: "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."

We’ll bring you more on this story.