Image source, Getty Images

The US Secret Service says its investigators are working "around the clock" to identify, freeze, trace, and recover funds stolen in what is thought to be the largest hack in history - worth up to $6.3bn (£4.7bn).

The affected firm Binance is the world's largest crypto exchange, which earlier said it had "begun recovering" some funds after yesterday's attack.

How did the hack happen?

Binance co-CEO Richard Tend said the hack attacked the firm's own hot wallet by abusing something called "multi-signature protocol EIP-7702".

This meant the thieves were able to bypass the usual methods of verification used by the platform - most of the money left Binance wallets in about 20 minutes, one expert told the BBC.

This did not involve just one person, and the hacker used a "self-destruct mechanism" to destroy tooling and traces as it went, Teng said.

Who was behind it?

Analysts suspect that North Korea could be behind the attack, with many pointing to the hacking unit TraderTraitor.

Why North Korea? Crypto theft is a big money-maker for the regime, our Japan correspondent writes.

What happens now?

Investigators are still looking into the attack, aiming to freeze assets and trace the hackers, while the US Federal Bureau of Investigation has said it is "aware of the incident".

Teng earlier said that Binance will share a full proof-of-reserves report by Monday and an initial view hopefully before that.

Withdrawal services remain switched off until they pass "rigorous testing", which Teng earlier said is "on track" to be completed within 40 hours.

If you are a Binance customer, our technology reporter Laura Cress explains how to check your accounts.

We are ending our live coverage now but you can read more in our story here.

Hack comes at troubling time for cryptopublished at 16:44 GMT

16:44 GMT

Joe Tidy
Cyber correspondent

This is a really troubling time for the cryptocurrency world.

Every year we are seeing enormous hacks of this kind of magnitude.

Last year $1.5bn (£1.12bn) was taken from Bybit.

Before that it was $600m (£433m) from Poly Network in 2021 and $540m (£412m) from Ronin in 2022.

As well as these hacks, which are a worry for industry titans like Binance and other cryptocurrency exchanges and companies, this is all a troubling time for individuals.

We have seen an increase in digital theft of cryptocurrency and attacks when people are being physically intimidated to hand over the private keys to their crypto wallets.

The value of cryptocurrency is such now that it is worth criminals going after people individually.

Mackenzie Jackson, from cybersecurity firm Aikido, tells the BBC that developer devices are attacked every day.

He says hackers have shifted from going after company infrastructure to going after the machines of the people who run it. Those machines hold the digital keys that unlock a company’s systems, so an attacker can act as that engineer.

Jackson says techniques vary, but include tricking workers into installing malware under the pretext of a job interview, or interfering with code that developers rely on.

"Binance says this was a more complex process than a single click, which points to a chain," he explains.

"From one laptop, an attacker can open one internal system, then another, until they reach a service trusted to send out withdrawals. Those withdrawals travel through a legitimate route, so they can look routine.”

Image source, VCG via Getty Images

We don't yet know who was behind the attack, but as our cyber correspondent Joe Tidy says, all fingers are pointing towards North Korea.

There are two main reasons for this: investigators including the FBI have blamed North Korea for similar hacks in the past, and crypto analytics firms say this hack looks like previous hacks widely attributed to North Korea.

"Several features of this attack match earlier North Korea-linked heists," says Blockchain intelligence firm TRM Labs.

It says it has "high confidence" that North Korean group TraderTraitor - also known as the Lazarus group - is responsible.

Chainalysis, another crypto analytics firm, also says it has a "high degree of confidence" that North Korea was behind the hack.

It says it observed funds stolen from Binance "commingling" with funds stolen from another hack of a different crypto exchange last month which was also widely attributed to North Korean actors.

North Korea has always denied it is behind such hacking, but Tidy says "the wealth of evidence from cryptocurrency flow analysis and insider interviews from defectors is compelling".

Binance has not responded to the BBC’s queries about possible links to North Korea.

After we heard from the FBI earlier, another US government agency has commented on the hack.

The US Secret Service, which is the lead federal agency for financial crimes and protecting the US financial system, says it's "working around the clock" with private sector partners "to identify, freeze, trace, and recover funds" stolen from Binance.

The agency goes on to say that it's "coordinating closely with the United States Attorney’s Office for the District of Columbia and law enforcement partners to identify the cyber criminals responsible and bring them to justice".

"Our investigation remains in its early stages, and we will provide additional information as appropriate.”

Losing $6.3bn doesn’t seem to be the end of the road for digital currenciespublished at 15:51 GMT

15:51 GMT

Kurumi Mori
Japan correspondent

Image source, EPA/Shutterstock

Bitcoin's value (BTC) fell after the news of the Binance hack, with its price dropping by about four percentage points.

But we should note that in the early days of crypto, BTC could lose 20% or 30% of its value in a single day after a cryptocurrency theft. So that's likely a sign that the crypto market has since matured.

And when you look at the bigger picture, there are trillions of dollars in crypto today, so losing this amount of $6.3 billion doesn’t seem to be the end of the road for digital currencies.

Still, Binance has called this a “complex attack” and we're yet to see how this will all play out.

Tara Mewawalla
Live reporter

Ari Redbord, chief policy officer of the crypto analytics company TRM Labs, tells the BBC what stands out in this incident is the speed of the theft.

Binance earlier said its initial investigation suggests the security incident may have involved a "compromised DevOps engineer's laptop" which allowed the hackers to gain access and submit unauthorised transactions.

Most of the $6.36bn left Binance wallets in about 20 minutes, Redbord says, starting at 20:05 GMT on Thursday.

"That speed is the product of long preparation," he says.

He explains that an "operator wallet" was funded 36 hours earlier by the hacker, and was most likely used to make transactions which allowed the hacker to gain access to the authorisation system.

The "signatures" to authorise those transactions would have been prepared in advance, Redbord adds.

Joe Tidy
Cyber correspondent

Image source, Getty Images

Binance co-CEO Richard Teng has posted a video on social media outlining the latest in the investigation into how the hack happened.

Teng says that the initial idea that hackers compromised Binance through a developer’s laptop is only part of the story.

"This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” he says.

Teng also describes how the hackers used sophisticated methods to hide their tracks. They used "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate”, he says.

Self-destructing traces is not that uncommon for skilled hackers and has been observed in many previous attacks.

Teng also confirms that the hackers used a new and controversial system to steal the coins.

By abusing something called "multi-signature protocol EIP-7702", the thieves were able to bypass the usual methods of verification used by the platform.

The transfers "did not pass through our normal approval controls”, Teng says.

But the full details about how the hack happened are still being figured out and Binance says it will update people - and the industry soon.

How could Binance be hacked if crypto is so secure?published at 15:23 GMT

15:23 GMT

Mitchell Labiak
Business reporter

One of the selling points of cryptocurrency is its security.

In short, the thinking is that you can use the blockchain - the cloud technology that underpins cryptocurrency - to create a publicly accessible list of every purchase and sale of cryptocurrency. And that ledger of transactions is impossible for any one person or computer to alter for their own ends.

And yet, here we are reckoning with the fallout from yet another massive crypto hack. So what’s going on?

The short version is that the blockchain wasn’t hacked. Rather, the exchange on which people trade cryptocurrency was hacked.

Because cryptocurrencies like Bitcoin cost so much money, many people choose to buy shares in a Bitcoin - or some other cryptocurrency - via an exchange. When people do this, the actual digital key to the cryptocurrency itself is held by the exchange, which is Binance in this case, on the costumer's behalf.

Purists would argue this undermines the whole philosophy of crypto as a decentralised currency that no single person can control. However, for those who are just looking to buy crypto in the hope its value will rise, exchanges are a handy shortcut.

That is, of course, until a massive issue like the Binance hack happens.

Image source, Bloomberg via Getty Images

More now from Binance co-CEO Richard Teng, who has released a video statement on X.

The attacker used a known multi-signature protocol EIP-7702 to obtain on-chain execution approval over a hot wallet, Teng says.

He says the delegation did not pass through the firm's normal approval controls, adding that this is why the withdrawal service needs to be paused so that investigations can be carried out.

Binance is rebuilding the withdrawal service and not switching it back until it "passes rigorous testing", Teng says, adding that Binance is "on track" to resume services within 40 hours.

The company is also conducting a full security review across the whole company, and completing the purchase of the remaining assets.

Binance will share a full proof-of-reserves report by Monday, he adds, and aim to give an initial view before that.

Liv McMahon
Technology reporter

After Binance said it was working with law enforcement following the hack, the US Federal Bureau of Investigation (FBI) has now commented.

The FBI has said in a statement it is "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps".

Image source, Getty Images

Richard Teng, Binance's co-CEO, has posted an update on X, explaining that what was affected in this hack was Binance's own hot wallet.

He says many people are asking how Binance can prove individual's assets are not impacted.

"We never use any customer funds so they are not impacted," he says.

Teng explains that user assets are held under Binance established security architecture, and the vast majority sit in cold wallets and are only moved into a hot wallet when the user makes a withdrawal.

He also gives an update on the investigation, saying that it is ongoing and is believed to involve more than more person.

He adds that it is believed the hacker used a "self-destruct mechanism", that destroyed tooling and traces as it went, "making it more difficult for us to trace".

Laura Cress
Technology reporter

Image source, Getty Images

Binance has not published a list of affected customer accounts in its incident update.

It says the attack involved unauthorised withdrawal transactions, but it has found no evidence of wallet private keys being leaked.

Customers can use the official app or website to review their balances, transaction history and security notifications for any unusual activity.

If they do spot anything suspicious, they should log out of all sessions, review their security settings and change their password - using an authenticator app or passkey to receive security codes, rather than text messages.

However, it is important to note that an account showing no unusual activity does not guarantee that their funds were unaffected.

Natasha Booty
Live reporter

Image source, Getty Images

Cryptocurrency fans say the fact it's not controlled by any centralised financial institution brings with it privacy and financial freedom.

With the race now on to trace crypto funds stolen from Binance, investigators will be monitoring any instances where it's converted into conventional money, because that greater visibility as it enters the real-world financial system makes it a key opportunity to intervene.

Converting crypto into normal money is called off-ramping. The opposite process is called on-ramping.

This can be done via major service networks including Visa and Mastercard, or cryptocurrency exchanges such as Coinbase or Binance.

Off-ramps and on-ramps are important in part because they allow new users to adopt cryptocurrency, rather than keeping it a closed sphere.

Jack Burgess
Live reporter

Image source, Reuters

"Cyber warfare is very much a tool in North Korea’s arsenal," North Korean foreign policy expert Dr Edward Howell, from the University of Oxford, tells me.

The author of A New Axis of Upheaval: North Korea, Russia, China, Iran says that, as of the current day, "around 40 to 50% of North Korea’s weapons of mass destruction programmes is funded by cyber and crypto-currency warfare".

Howell says the North Korean regime will "do everything and anything it can to get cash".

"We’ve got to remember that North Korea basically has a state-run cyber warfare agency," he says, adding that the infamous Lazarus group - also known as TraderTraitor - "is likely behind this Binance attack".

North Korea has never admitted being behind the Lazarus Group, but in 2020 the US added North Koreans accused of being part of the Lazarus Group to its Cyber Most Wanted list.

This is the biggest hack in history and probably the biggest single theft of any kind, our cyber correspondent Joe Tidy says. He talks you through the key details in less than a minute - watch below:

It is difficult to get a sense of how many people worldwide own crypto, although it has attracted significant interest in recent years.

• Around 8% of adults in the UK own cryptoassets, according to the latest research from the Financial Conduct Authority in 2025
• Around 8.7% of the US population owns them, according to the Securities and Exchange Commission
• In the euro area, around 9.7% of people (or someone in their household) own cryptoassets, according to a 2024 survey of select countries carried out by the European Central Bank

Data from official sources is not readily available for all countries, including India and China.

It's also worth bearing in mind that some people have minimal exposure - just 'dabbling' for fun - while others invest more significant amounts.

Of course, not everyone who trades crypto will use Binance - the company which has been hacked.

It is, however, a significant player, describing itself as "the largest crypto exchange by trade volume" with an average daily volume of $95bn (£71bn). It is estimated to have more than 300 million registered users worldwide.

Binance has insisted user funds are safe, adding that it will cover all losses.

However, the impact of the incident goes beyond just those who use the platform, with the Bitcoin price having dropped by around 5%.

Joe Tidy
Cyber correspondent

All eyes are on the value of Bitcoin. The famous green or red line dictating how much a single bitcoin is worth acts like a barometer for how healthy the entire industry is.

And right now it is holding up, only losing $3,000 (£2,200) since it started falling from $80,000 (£59,700) when the hack was announced.

Some are saying this shows how resilient bitcoin has become. Previous hacks and major events have seen the coin value tank.

However, it's important to note that Binance, and some other exchanges and networks, have frozen all trading whilst they deal with the hack.

So it remains to be seen how the value will go once people are able to actually buy or sell their crypto.

Liv McMahon
Technology reporter

Image source, Getty Images

This isn't the first time Binance has been hacked, or had to suspend withdrawals - it's had to do that several times before and in various markets in response to impacts on its operations or regulatory decisions.

The world’s largest crypto exchange disclosed a “large scale” breach in May 2019 after hackers stole cryptocurrency then valued at $41m (£31m).

Binance said hackers stole 7,000 bitcoins in one go - now worth around $400m - and it suspended withdrawals for several days.

It said the attackers had used a variety of techniques to break in - including viruses and phishing attacks to access security information - and it begged users for their understanding.

The exchange also pledged to replace lost cash with the help of its Secure Asset Fund for Users (Safu) – an emergency insurance fund.

Binance has taken similar actions and made similar pledges to users today, after suffering what may be the largest-ever hack of its kind.

Tara Mewawalla
Live reporter

Image source, Getty Images

The world's biggest crypto exchange Binance says it has "begun recovering affected assets for users", after it was hit by what is thought to be the biggest hack in history.

Cryptocurrency worth $6.3bn (£4.7bn) was stolen in the mega-hack, and trading on platform Binance Alpha was temporarily suspended last night - read a timeline of Binance's response here.

In its latest update, the firm reiterated that it has committed to cover losses through company funds, and says it has reserved over $6.3bn (£4.7bn) to cover the incident.

It said frozen or protected assets remain subject to ongoing recovery and verification. Earlier, it said $3bn (£2.24bn) had already been frozen.

The initial investigation suggests the incident may have begun with a "compromised DevOps engineer's laptop", Richard Teng, Binance's co chief executive says, but adds that it's a "complex attack".

We don't know who is behind the attack but analysts have pointed to North Korean hacking unit TraderTraitor. Why North Korea? Crypto theft is a big money-maker for the regime, our Japan correspondent writes.

Binance says it is working with law enforcement to find the criminals, though our senior technology reporter Shiona McCallum says investigators' efforts to follow the money could take months.

How did the attack happen? What is Binance? Our live reporter answers the seven major questions in our earlier post.