image copyrightGetty Images
Binance, the world's largest cryptocurrency exchange, suffered what is believed to be the largest hack in history, worth $6.3 billion.
Cryptocurrencies are a type of digital asset that does not exist physically like cash. Instead, users use digital wallets on their smartphones or computers to access and manage them.
Richard Teng, co-CEO of Binance, stated that the company is working with authorities to clarify what happened and will cover all losses.
Early analyzes by industry experts suggest that groups associated with North Korea could be behind the computer attack, something that has not been confirmed.
In recent years, North Korean state-sponsored cyberattacks have increasingly focused on the theft of large amounts of cryptocurrency, which has become a major source of income for the Pyongyang regime.
This is what we know so far.
What is Binance?
Binance is the world's largest cryptocurrency exchange by trading volume.
On this platform, users can buy, sell and exchange digital currencies, such as Bitcoin, as well as deposit and withdraw them.
End of Most read
It was founded in China in 2017 and has hundreds of millions of registered users around the world.
Binance has been under scrutiny in recent years, especially in 2023, when its then-CEO Changpeng Zhao resigned after pleading guilty to money laundering offences.
Last year, a lawsuit in the United States accused the company of helping send millions of dollars to organizations that the US government has designated as terrorists.
The company claimed in 2024 to have assets worth more than $160 billion.
How did the hack occur?
All the news you need is on BBC World Service
Download it here
End of Ad app
The hack occurred on Binance.com, Binance's global centralized exchange platform.
Binance.us, which offers trading services specifically for US residents, stated that it has not been affected by this issue.
In a statement, Teng said: "Our initial investigation suggests that this security incident may have started with a development and operations engineer's laptop being compromised."
"That gave the attacker access to a service container, from which he sent unauthorized withdrawal transactions."
As he explained, the computer attack "was not a simple 'one-click' action," but a "more complex attack process."
Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean that an engineer was "persuaded to do a test" and that malware "was installed on his laptop while doing it."
According to Nandakumara, since the laptop already had sufficient security privileges, early reports suggest that it became "the attacker's gateway directly to production and from there to wallets."
“You can build a vault with mathematical firewalls, but if you can trick the person who has the keys, the vault opens,” said Dr. Clive Summerfield, director of FARx, an AI biometrics and security company.
image copyrightBloomberg via Getty Images
Who is behind the hack?
It is still unknown who is behind the attack, but some data analysis firms have pointed the finger at North Korea. It has not been confirmed.
AI-powered research firm TRM Labs said in a report that several elements of the Binance attack resembled previous incidents linked to the country, including a $1.5 billion hack on the ByBit platform in 2025.
These previous attacks have been linked to a group of cybercriminals accused of working directly for the North Korean regime, called the Lazarus Group, also known as TraderTraitor.
Dr. Edward Howell, an expert on North Korean foreign policy at Oxford University, told the BBC that Pyongyang "has a long history of using cyber warfare to extract money."
Howell claimed that North Korea "basically has a state cyberwarfare agency," which it uses "to finance its weapons of mass destruction programs" and as an "illicit fund" for the regime of its leader, Kim Jong-un.
Howell added that, today, "between 40 and 50% of North Korea's weapons of mass destruction programs are funded through cyberwarfare and cryptocurrencies."
North Korea has always denied any involvement in these attacks; Binance has not responded directly to the BBC's questions about the incident's possible links to the area.
What does this mean for Binance users?
In his statement, Teng stated that Binance users' funds are safe and that as a precautionary measure, all deposits and withdrawals have been temporarily suspended.
He said that the company would cover all losses with its emergency reserve created for this type of situation, and that the rest would be covered with the company's own funds.
Binance has stated that it has been working with its partners to freeze the affected assets, with around $3 billion reportedly already located.
Teng said concerned users can check their Binance accounts. Experts recommend doing so through the official app and website, and contacting the company's customer service if you have any questions.
Users of other cryptocurrency platforms have also been warned to be wary of hackers trying to take advantage of the situation.
Marijus Briedis, chief technology officer at NordVPN, said users should be alert for things like "an email claiming your funds are at risk," "a fake support account offering help," or "a message urging you to transfer your cryptocurrency to a 'secure' wallet."
“Check for updates through the Binance app or a web address you already trust,” he advised.
He also recommended: "Avoid links in unsolicited messages and never give anyone your password, verification codes or wallet recovery phrase."
What does this mean for cryptocurrencies and the financial system in general?
Jennifer Craven, an international trade fraud expert at law firm Pinsent Masons, said the fallout from the hack could “extend far beyond Binance.”
"More generally, the incident highlights the fragility of some sectors of the crypto ecosystem," he said.
"If a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what implications that has for smaller, less mature platforms and cryptocurrencies."
The attack will likely accelerate scrutiny over how the industry protects both its infrastructure and its customers, he said.
Although there is still no evidence that artificial intelligence was used in this attack, there is much broader concern in the financial sector about whether AI agents could identify vulnerabilities in software and figure out how to exploit them much faster than human hackers.
The Bank of England has warned that this could make it harder for institutions to patch vulnerabilities before attackers take advantage of them.
How many people use cryptocurrencies?
Cryptocurrencies have become an increasingly popular way to invest and transfer money online, in part because, unlike traditional currencies, they are not controlled by central banks or governments.
This makes them popular among people who believe that decentralization can bring financial freedom.
But also extremely volatile, since their value rises and falls following the behavior of buyers and sellers.
According to Solcard, a virtual card and payment platform funded by cryptocurrencies, between 560 and 741 million people will own cryptocurrencies worldwide in 2026.
This article was originally written in English and we used an artificial intelligence tool to translate it. A BBC journalist reviewed the text before publication. Learn more about how we use AI.
Discover more
Video
End of Video
