World’s largest crypto exchange hit by suspected North Korean hack in world’s largest heist

By Sean Lyngaas, CNN

(CNN) — Binance, the world’s largest cryptocurrency exchange, suspended withdrawals after hackers broke into its digital wallets and stole $6 billion in what appears to be the biggest crypto heist ever.

Binance said late Thursday that its initial investigation indicated the hack went through an engineer’s laptop, “which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Blockchain evidence suggests the hack originated in North Korea, according to multiple crypto-tracing firms.

A team of cryptocurrency firms managed to freeze about $3 billion of the stolen loot amid a frenetic battle with the hackers to find and control the digital money.

Binance co-CEO Richard Tend said on X that the attack was not a “one-click” action, but rather a complex process. The investigation has not attributed responsibility to any individual nor found evidence of any wallet private key leak.

Binance said it would cover all losses from the company’s funds and an emergency assets fund, adding “user funds are safe.” The crypto exchange said it had temporarily suspended deposits and withdrawals to allow security checks to be completed and blockchain intelligence partners to trace and recover funds. The crypto exchange expects withdrawal services to resume by Sunday morning.

Crypto-tracing firm TRM Labs attributed the heist to an elite North Korean hacking unit “based on robust on and off-chain intelligence,” pointing out that “several features of this attack match earlier North Korea-linked heists.”

Pangolin Intelligence, another blockchain-tracking firm based in Singapore, said it also believed that a North Korean hacking unit was behind the heist.

“Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents” led to the attribution, said an analyst with Pangolin Intelligence, who did not want to be named for privacy reasons.

“I think the cat and mouse game has barely begun yet,” the Pangolin Intelligence analyst told CNN, adding that North Korea was likely poised to tap a network of money laundering organizations to try to cash out the stolen funds.

Chainalysis, another crypto-tracking company, said it was monitoring stolen funds “moving across multiple blockchains,” including bitcoin and ethereum. A Chainalysis spokesperson told CNN the firm had “high confidence” North Korea was behind the hack.

CNN has reached out to North Korea’s mission at the UN for comment. Pyongyang has previously denied hacking allegations.

CNN has requested comment from the FBI, as well as the US Secret Service, which also investigates cybercrime. In past investigations of big crypto hacks, the FBI has had an on-call team of analysts that worked to freeze some of the money.

If North Korea is proven to be the culprit, it would be little surprise to US law enforcement officials and private experts. North Korean hackers were blamed for the previous record-high crypto hack, when they allegedly stole $1.5 billion from Bybit, another major cryptocurrency exchange. In that case, the attackers stole an amount equal to a significant portion of North Korea’s reported annual gross domestic product in a matter of minutes.

North Korea’s formidable hacking teams are a key source of revenue for the nuclear-armed, sanctions-battered regime, according to current and former US and South Korean officials. Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in the last several years, according to reports from the United Nations and private firms.

A 2023 CNN investigation spotlighted how the South Korean intelligence service worked with private crypto-tracking experts to seize about $1 million in cryptocurrency that North Koreans had stolen from a victim.

Unlike platforms for trading stocks, cryptocurrency exchanges tend to hold digital assets on their users’ behalf, which make them more vulnerable to hackers and theft, particularly given a lack of regulatory oversight within the relatively nascent industry.

Binance was co-founded in 2017 by Canadian national Changpeng Zhao, becoming the world’s largest crypto trading platform within a year of its launch.

However, Zhao stepped down in 2023 after pleading guilty to violating anti-money laundering laws in the US. He was sentenced to four months in federal prison, and was pardoned by President Donald Trump in October last year.

Zhao, who no longer manages the platform but remains its largest shareholder, said on X that he expects user funds to be fully covered by the exchange, pushing back against any suggestion to the contrary in a spat on X with Elon Musk.

Prices of bitcoin and ether, the most widely traded cryptocurrencies, plummeted following news of the Binance breach, but regained some losses to trade about 2-3% lower midday Friday in Hong Kong.

This story has been updated.

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.