Binance, the world's biggest crypto exchange, has been hit by what's thought to be the biggest hack in history at $6.3bn (£4.7bn) - here's how it compares to other attacks
The company's co-CEO Richard Teng says initial investigations suggest a "compromised DevOps engineer's laptop" gave hackers access - but adds the "complex attack" was not a "single 'one-click' action"
Teng also tells customers their "money is safe, and we're covering every loss"
The crypto industry has been beset by enormous losses from hackers in the last few years, with investigators almost always blaming hackers from North Korea, writes our cyber correspondent
Blockchain intelligence firm TRM Labs says several elements of the Binance attack resemble earlier North Korean-linked incidents, including last year's $1.5bn Bybit hack
This latest hack is thought to be the biggest ever.
In nearly all previous cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group - also know as TraderTraitor.
It's still not known who's behind the Binance attack - but fingers are once again pointing towards North Korea, which has always denied wrongdoing.
Image source, Getty ImagesCrypto is a type of digital currency and does not exist as paper bills or metal coins; they exist as electronic data entries.
Unlike traditional currencies, they are not controlled by centralised financial institutions.
This makes it popular for people who think decentralisation can bring financial freedom, but it also makes it extremely volatile with it rising and falling in value at the whim of buyers and sellers.
Blockchain is the technology underpinning all cryptocurrencies.
In essence, it is a virtual spreadsheet on which all the buying and selling of crypto is recorded. They are arranged in blocks linked together in a giant chain - hence the name.
Every cryptocurrency transaction is individually recorded onto the blockchain by a huge network of volunteers verifying its authenticity by using computer programmes.
We can now bring you the latest update from Binance about the hack.
The crypto exchange says that while its initial investigation suggested the incident may have involved a "compromised laptop", further digging has "uncovered additional points of breach".
No further details about the breaches are offered, but Binance says it will continue to provide updates about the investigation.
It goes on to say that "Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
"We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected."
The exchange adds that it is working with its partners to freeze affected assets and has "frozen around $3 billion thus far."
Image source, Getty ImagesBitcoin - the original cryptocurrency - has dropped about 5% in value to roughly $76,400 (£56,900), according to multiple reports.
That's its lowest value in a month, says the AFP news agency. It's not the only cryptocurrency to suffer: Bloomberg reports that the Ether, Solana and XRP tokens also fell.
This is thought to be the largest crypto hack on record, but the reason it stands out is because of how it was carried out, according to expert Jayant Dave from cyber security firm Check Point.
"The attackers didn't break the encryption or steal the private keys. They took over the system that tells the keys what to sign," he says.
He says Binance's early findings point to one compromised engineer's laptop, with attackers using it to reach a service that could submit withdrawals, moving billions "within minutes".
"That's the lesson: a strong vault doesn't matter if someone controls the process that opens it," Dave says.
He says it's not just crypto companies that are exposed to this risk. He says that banks or other institutions with automated systems that move money or data on instruction face the same risk.
Joe Tidy
Cyber correspondent
In the last five years the crypto industry has been beset by enormous losses from hackers.
Each year seems to see a more devastating hack, with crypto exchanges often the target.
In nearly all cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group - also know as TraderTraitor. The names refer to clusters of cyber criminals accused of working directly for the regime.
North Korea is an impoverished country with very little industry and heavy international sanctions and experts say the regime uses cyber crime as a way to bring money in.
North Korea has always denied this, but the wealth of evidence from cryptocurrency flow analysis and insider interviews from defectors is compelling. It makes North Korea likely to be the only nation that uses hacking as a way to raise public funds.
Emily Taylor, co-founder of the Global Signal Exchange, an organisation that helps prevent scams and other forms of cyber crime, has been speaking to BBC Radio 4's Today programme.
She says that the financial losses set a "grim new record", but also says this hack was conducted "on a speed and scale we've never seen".
"It also highlights very much our dependence on technology," she adds. "The way that we do money these days is different to how we did it 10, 20, 30 years ago."
Taylor says a signature technique for hackers to gain access to systems is to lure people with very responsible engineering jobs with fake job adverts.
They then go on to persuade them to download a test or other software which compromises their computer.
"So if you think of an engineer with a very responsible job in a situation like Binance, they will have a very wide-ranging ability to go all over the system to make withdrawals and so on because they're responsible for keeping the system safe."
Image source, Getty ImagesBybit co-founder and chief executive Ben Zhou
This latest hack targeting Binance is thought to be the largest in history and eclipses a previous attack on the Bybit exchange in 2025.
In the 2025 incident, hackers thought to be working for North Korea - in a network known as Lazarus Group, also referred to as TraderTraitor by the US government - swiped $1.5bn (£1.1bn).
Within around two weeks of the attack, they had managed to successfully convert at least $300m into unrecoverable funds.
In a post on X in August this year - 18 months after the attack - Bybit co-founder Ben Zhou said the company had been "working on recovery from every possible angle" and had recovered around $48.4m, with another $30.5m "frozen".
He added that the exchange had also filed a civil lawsuit against North Korea and the Lazarus Group.
AI-powered investigations company TRM Labs has said that several elements of the latest Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.
Image source, Getty ImagesBinance co-CEO Richard Teng speaks at a conference in this file photo
Here's the full statement from Richard Teng, Binance's co-CEO:
"I want to speak to you directly about what happened. Bottom line - your money is safe, and we're covering every loss.
"Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.
"We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete.
"What you need to know:
"What we've done:
"Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can."
Richard Teng, the co-CEO of Binance, has just released a statement on X.
In it, he says the company's "initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop".
But, he goes on: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process."
We'll bring you his statement, in full, in our next post.
The identity of the hackers is unclear.
Binance says it is "working closely" with law enforcement to identify them and "bring them to justice".
It has not directly responded to BBC queries about the incident's potential links to North Korea.
It comes after two analytics firms attributed the incident to a North Korean hacking unit called TraderTraitor.
AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korean-linked incidents, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025.
Chainalysis, another crypto analytics firm, also said it has "high confidence" that the North Korean group are linked to the hack.
Image source, ReutersBinance is the world's biggest cryptocurrency exchange.
Founded in China in 2017, it allows users to trade digital assets and has hundreds of millions registered users worldwide.
The hacking incident concerns Binance.com, a centralised exchange that offers users a range of financial products and services. Those include purchasing and trading a wide range of digital currencies, as well as digital wallets, futures, securities, savings accounts and even lending.
Binance.US, which provides trading services specifically for American residents - said its platform is not affected by the issue.
The exchange has been subject of regulatory scrutiny around the world.
Last year, a lawsuit in the US accused the company of helping send millions of dollars to US- designated terrorist organisations.
The company said in 2024 that it has more than $160bn in assets under custody.
This story is still developing, with crypto giant Binance saying it is working with law enforcement to confirm the identity of the criminals.
What we know
What we don’t know
Image source, Bloomberg via Getty ImagesCryptocurrency giant Binance has said that $6.3bn (£4.7bn) of digital assets have been impacted by what could be the largest hack in history.
The world's biggest crypto exchange says about half of those assets had been frozen but that many remained in the hands of the hackers, adding that it will "cover all losses".
Early checks show the incident may have involved an engineer's laptop that had been compromised, which allowed an attacker to make unauthorised withdrawals, Binance says.
Two analytics firms have attributed the incident, which eclipses a record-setting $1.5bn hack on the Bybit exchange in 2025, to a North Korean hacking unit called TraderTraitor.
Binance did not directly respond to BBC queries about the incident's potential links to North Korea but said: "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
We’ll bring you more on this story.
