Binance, the world's largest cryptocurrency exchange, said hackers stole approximately $6.3 billion in what analysts are calling the largest cryptocurrency theft on record. The exchange said it will cover all customer losses.

In a security incident update published on its website, Binance said its initial investigation suggests the breach "may involve a compromised DevOps engineer's laptop," which allowed an attacker to access a service container and submit unauthorized withdrawals. "We have found no evidence of any wallet private key leak," the exchange added. If confirmed, that finding would mean the attackers exploited internal access rather than the private keys that control customer wallets.

Binance said roughly $3 billion has been frozen on-chain so far, with assistance from law enforcement agencies, stablecoin issuers, and blockchain intelligence firms. The company had earlier put the verified figure at $2.54 billion and warned the total could rise. Freezes of this scale rely on exactly that kind of cross-party cooperation, and the total locked down can change as the investigation progresses.

Analysts Point to North Korea

United States blockchain analysis firms TRM Labs and Chainalysis said the attackers were from North Korea, according to Reuters. TRM Labs said the attackers targeted Binance wallets across 10 blockchains and moved most of the funds within roughly 20 minutes.

The firm said several features of the attack matched earlier heists linked to North Korea, including the 2025 Bybit hack, which the U.S. Federal Bureau of Investigation attributed to Pyongyang. "We make this judgment with high confidence," TRM Labs said.

Binance has not named the attackers, saying it is working with law enforcement "to confirm the identity of these criminals." North Korea's mission in Geneva and its embassy in China did not immediately respond to Reuters.

What It Means for Binance Users

Binance said it has temporarily suspended deposits and withdrawals while security checks continue. The exchange has also revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners to trace and recover the funds.

In a separate post on X, the company said deposits were unaffected and that it expected to resume withdrawals within 48 hours.

Losses will be covered by the exchange's Secure Asset Fund for Users (SAFU) — an emergency insurance reserve — and company funds. "User funds are safe," Binance said.

The exchange had about $162.8 billion in assets under custody and 335 million registered users, according to its 2025 annual report, as cited by Reuters.

Markets reacted quickly to the news. Bitcoin fell more than 3% to a six-week low of $76,368, while Ether dropped more than 3% to a two-month low of $2,178. BNB, Binance's exchange token, was down 5% over 24 hours at $709.70, according to CoinGecko.

"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks," said Tim Sun, senior researcher at HashKey Group, per Reuters.

The incident adds to a string of large-scale thefts across the industry. Attackers stole $2.9 billion in cryptocurrency last year across nearly 150 attacks, according to TRM Labs. Bitget said in September that roughly $350 million had been stolen from its platform.

Other Exchanges Say They Were Not Hit

A list circulating on social media claimed that Binance, Bybit, Bitget, and Swyftx had all been hacked on the same day. The other three exchanges have denied the claim.

"Bybit is not affected," the exchange said. Bitget said it "remains secure and fully operational." Swyftx said its security team "has found no evidence of a breach."

Binance.US said it is a separate, independent platform and was not affected. Crypto.com and Blockchain.com also said their platforms are operating normally. Coinbase said it was unaffected and is monitoring the situation, per Reuters.

Figures for the theft also differ across reports. Watcher.Guru, posting on X, put the amount at over $5.6 billion, while Binance's own estimate is around $6.3 billion.

Polymarket, the prediction market, separately halted trading on its international platform on Thursday after a security incident involving a third-party provider. Reuters described the incident as unrelated to the Binance attack.

According to security firm Hudson Rock, as reported by Cyber Kendra, a malicious script served through web performance firm DebugBear searched for logged-in trading sessions and sold users' positions. One trader said he lost about $800,000. DebugBear said on X that it was "impacted by an ongoing security incident."

Polymarket said it has fixed the issue and referred the matter to law enforcement. "Anyone who has been impacted will be made whole," the platform said. It has not disclosed how many accounts were affected or how much was taken.

Binance said it will publish a detailed technical post-mortem and an updated Proof of Reserves once its investigation and remediation are complete — the two documents that will show the full technical scope of the breach and the current state of the exchange's reserves.