Binance said on Thursday that $6.3 billion (£4.7 billion) of digital assets were affected by what has been described as the "largest hack in history." The world's biggest crypto exchange said about half of those assets have been frozen with the help of other platforms, and that it will "cover all losses."
Binance said early checks suggest an engineer's laptop may have been compromised, allowing an attacker to make unauthorised withdrawals.
AI-powered investigations company TRM Labs attributed the incident to a North Korean hacking unit called TraderTraitor. "We make this judgment with high confidence," TRM said in a report. The report said several elements of the attack resemble earlier North Korean-linked incidents, including the Bybit hack. TRM's chief policy officer, Ari Redbord, told the BBC the incident is a "watershed moment." Binance did not directly respond to questions about possible links to North Korea. It said it is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
Binance said the issue concerns Binance.com and that its US platform, Binance.US, is not affected.
Binance co-chief executive Yi He thanked crypto issuers for freezing assets. She said withdrawals are disabled "until the environment is confirmed to be secure."
Tether said it has frozen around $1.6 billion related to the potential hack. Circle said it has frozen more than $800 million in linked assets. Coinbase said it was unaffected and is monitoring the situation.
Bitcoin fell by more than 4% after the alerts, and Ethereum and Solana also fell sharply.