Newsroom
Customers of cryptocurrency exchange Binance face a wait to withdraw their money after a cyberattack affected an estimated $6.3 billion in digital assets, potentially making it the largest cryptocurrency theft on record.
Binance says it will cover all losses and has worked with industry partners to freeze about $3 billion in affected assets. That blocks those funds from being moved, although the final financial damage is still being assessed.
For ordinary users, including those in Cyprus holding cryptocurrency on Binance.com, the immediate issue is access to their funds. In its latest update, the company said deposits were operating normally but withdrawals remained suspended while it strengthened security. It expected withdrawals to resume within 48 hours—an estimate rather than a confirmed reopening time.
One of the most striking details is the suspected entry point: an employee’s laptop.
Binance said preliminary findings suggested a compromised computer belonging to an engineer may have allowed the attacker into an internal system, where unauthorized withdrawals were submitted. It said it had found no evidence that the private security keys controlling its digital wallets had leaked. The cause remains under investigation.
Suspected North Korean link
Cryptocurrency investigators TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean hacking group. TRM said the operation shared features with earlier attacks, including the $1.5 billion theft from rival exchange Bybit in 2025. The attribution has not been confirmed by Binance, which says it is working with law enforcement to identify those responsible.
If the estimated scale is confirmed, the Binance attack would be more than four times the size of the Bybit theft.
Binance said it would use its emergency protection fund and company resources to cover losses. It also promised a detailed technical report once investigators had verified what happened.
For customers, the distinction is significant: the company’s promise to protect their balances does not mean they can immediately withdraw them. That depends on the completion of the security work.
