(CNN) — Binance, the world’s largest cryptocurrency exchange, has suspended withdrawals after hackers broke into its digital wallets and stole $6 billion in what appears to be the biggest crypto heist ever.
The exchange said Friday that it has begun recovering affected assets and was continuing to work with law enforcement and blockchain intelligence firms to trace additional funds.
An initial investigation suggested the hack went through an engineer’s laptop, “which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” Binance said late on Thursday. Blockchain evidence suggests the hack originated in North Korea, according to multiple crypto-tracing firms.
A team of cryptocurrency firms managed to freeze about $3 billion of the stolen loot amid a frenetic battle with the hackers to find and control the digital money.
Binance co-CEO Richard Tend said on X that the attack was not a “one-click” action, but rather a complex process. The investigation has not attributed responsibility to any individual nor found evidence of any wallet private key leak.
Binance said it would cover all losses from the company’s funds and an emergency assets fund, adding “user funds are safe.” The crypto exchange said it had temporarily suspended deposits and withdrawals to allow security checks to be completed and blockchain intelligence partners to trace and recover funds. The crypto exchange expects withdrawal services to resume by Sunday morning.
Crypto-tracing firm TRM Labs attributed the heist to an elite North Korean hacking unit “based on robust on and off-chain intelligence,” pointing out that “several features of this attack match earlier North Korea-linked heists.”
Pangolin Intelligence, another blockchain-tracking firm based in Singapore, said it also believed that a North Korean hacking unit was behind the heist.
“Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents” led to the attribution, said an analyst with Pangolin Intelligence, who did not want to be named for privacy reasons.
“I think the cat and mouse game has barely begun yet,” the Pangolin Intelligence analyst told CNN, adding that North Korea was likely poised to tap a network of money laundering organizations to try to cash out the stolen funds.
Chainalysis, another crypto-tracking company, said it was monitoring stolen funds “moving across multiple blockchains,” including bitcoin and ethereum. A Chainalysis spokesperson told CNN the firm had “high confidence” North Korea was behind the hack.
CNN has reached out to North Korea’s mission at the UN for comment. Pyongyang has previously denied hacking allegations.
In past investigations of big crypto hacks, the FBI has had an on-call team of analysts that worked to freeze some of the money.
The FBI said in a statement Friday that it is “aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”
A spokesperson for the US Secret Service, which also investigates cybercrime, said the agency’s “investigators are working around the clock with our private-sector partners, including Circle [the company behind the US dollar-backed stablecoin USDC], to identify, freeze, trace, and recover funds stolen from Binance on Thursday. We are also coordinating closely with the United States Attorney’s Office for the District of Columbia and law enforcement partners to identify the cyber criminals responsible and bring them to justice.”
If North Korea is proven to be the culprit, it would be little surprise to US law enforcement officials and private experts. North Korean hackers were blamed for the previous record-high crypto hack, when they allegedly stole $1.5 billion from Bybit, another major cryptocurrency exchange. In that case, the attackers stole an amount equal to a significant portion of North Korea’s reported annual gross domestic product in a matter of minutes.
North Korea’s formidable hacking teams are a key source of revenue for the nuclear-armed, sanctions-battered regime, according to current and former US and South Korean officials. Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in the last several years, according to reports from the United Nations and private firms.
A 2023 CNN investigation spotlighted how the South Korean intelligence service worked with private crypto-tracking experts to seize about $1 million in cryptocurrency that North Koreans had stolen from a victim.
Unlike platforms for trading stocks, cryptocurrency exchanges tend to hold digital assets on their users’ behalf, which make them more vulnerable to hackers and theft, particularly given a lack of regulatory oversight within the relatively nascent industry.
Binance was co-founded in 2017 by Canadian national Changpeng Zhao, becoming the world’s largest crypto trading platform within a year of its launch.
However, Zhao stepped down in 2023 after pleading guilty to violating anti-money laundering laws in the US. He was sentenced to four months in federal prison, and was pardoned by President Donald Trump in October last year.
Zhao, who no longer manages the platform but remains its largest shareholder, said on X that he expects user funds to be fully covered by the exchange, pushing back against any suggestion to the contrary in a spat on X with Elon Musk.
Prices of bitcoin and ether, the most widely traded cryptocurrencies, plummeted following news of the Binance breach, but regained some losses to trade about 2-3% lower midday Friday in Hong Kong.
The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.