Cryptocurrency platform Binance said it was working to resolve a 'complex attack' that hit around $6.3billion in funds, with about half that amount frozen to prevent a massive theft.

The company, the world's largest crypto exchange by daily trading volumes, said investigations had 'uncovered additional points of breach,' contrary to initial findings that suggested the hack involved a single compromised laptop.  

It had posted a series of sometimes contradictory messages on X, insisting that 'user funds are completely safe' but also saying it would 'cover all losses'.

'This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,' Binance wrote on X.

The heist could be the largest in history and may have been led by North Korean hackers. 

Binance said on its X account for Latin America late Thursday the estimated total impact was 'around $6.3 billion,' which could be one of the most significant of such security incidents on record.

The figure is four times the amount affected in the biggest-ever cyber-attack of its kind to date: $1.5billion taken in February last year from the Bybit platform.

The 2025 Bybit heist was attributed at the time to a group of hackers affiliated with North Korea called TraderTraitor.

Blockchain investigation firm TRM Labs said Thursday it had 'high confidence' that the Binance hack was also orchestrated by TraderTraitor, citing 'robust on and off-chain intelligence.'

'Several features of this attack match earlier North Korea-linked heists,' TRM said.

TraderTraitor is believed to be part of Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong Un. 

At about 9am GMT Friday, Binance said it was on track to resume withdrawals in 45 hours, after announcing earlier that all deposits and withdrawals had been 'temporarily suspended.'

'Deposits remain unaffected,' it said.

The company had said on X that initial investigation suggested the hack involved a compromised laptop belonging to a 'DevOps engineer,' allowing the unauthorised party to access a 'service container' and execute unauthorised withdrawal transactions.

'We have found no evidence of any private key leaks from wallets,' it said, promising to share a detailed technical analysis once investigations were complete.

But it said later that 'subsequent investigation has uncovered additional points of breach.'

For several hours before Binance confirmed the attack, industry observers said hackers had managed to reach the platform.

The prices of most major cryptocurrencies fell on news of the cyber-attack, except for the stablecoins, which by definition can only fluctuate within tight margins.

Bitcoin and Ethereum plunged nearly five per cent and nearly six per cent respectively on the news. BNB, native to Binance, tumbled nearly 10 per cent.

The attack on Binance comes as many observers express worries that the ever-expanding capabilities of artificial intelligence (AI) models could compromise cryptography and IT security protocols.

Binance warned the figure 'may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets'.

It said around $3billion in affected assets had been frozen.

It was not immediately clear the extent of the damage hackers might have been able to cause, and Binance had not explicitly confirmed that funds had been pilfered. 

The company said its teams were 'working around the clock' to resolve the issue.

AI-powered investigations company TRM Labs said elements of the attack resembled earlier North Korea-linked hacks.

A Binance spokesman said: 'Rest assured that user funds are completely safe.

'Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information,' the statement continued.

The company said it has worked with blockchain partners to freeze affected assets, with roughly $3billion frozen on-chain so far.

'Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,' the company wrote. 

'We have found no evidence of any wallet private key leak,' it added.

Binance said it will share more technical details once the investigation is complete and when the facts are 'fully verified.'

'Our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets,' the company wrote in a separate post earlier Thursday.

Stablecoin providers Tether and Circle each said they froze funds Thursday in response to the incident.

Jeremy Allaire, co-founder and CEO of Circle, wrote on X that the company had frozen the equivalent of more than $800million in currency associated with the incident 'in coordination with law enforcement.'

Tether CEO Paolo Ardoino said on X that the company froze the equivalent of more than $1.5billion in currency related to 'a potential Binance exchange hack.'

The price of bitcoin dropped 3.2 per cent Thursday evening to under $79,000.

Binance was founded in 2017 by Changpeng Zhao, who in 2023 pleaded guilty to a felony related to his failure to prevent money laundering on the platform and stepped down as CEO. President Donald Trump pardoned him in 2025.

Mr Zhao posted on X on Thursday that 'User funds are safe!' but added that the incident 'does look like a hack on Binance.' 

He said that while he doesn´t manage Binance any more, 'as a shareholder, I expect all user funds will be fully covered.'

Mr Zhao was released from prison in 2024 after being sentenced for violating the Bank Secrecy Act.

He was the first person ever sentenced to prison time for violations of that law, which requires US financial institutions to know who their customers are, to monitor transactions and to file reports of suspicious activity.

Prosecutors said no one had ever violated the regulations to the extent Zhao did. Mr Zhao and Binance have been key supporters of some of the Trump family´s crypto enterprises.