Binance says it has frozen about half of the funds stolen in a "complex" hack that saw $6.3bn (£4.7bn) accessed. The firm said $3bn of its stolen digital assets had been secured, while many were still in the hands of unidentified hackers.
Binance first thought an engineer's laptop had been compromised, allowing unauthorised withdrawals. Co-CEO Richard Teng later said the breach was broader. "This was not carried out by one person," he said, adding that investigators had "uncovered additional points of breach." He also said the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went."
Several analytics firms have linked the hack to a North Korean hacking unit. Chainalysis said it had "high confidence" that a North Korean group is linked to the hack. TRM Labs said several elements resembled earlier North Korean-linked incidents, including the 2025 Bybit hack. North Korea has denied involvement.
The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover the stolen funds. Binance said it is working with the FBI. Binance said its US-facing exchange was unaffected.
Binance said in an update that deposits remain unaffected and that it had set aside more than $6.34bn in company funds to cover the losses. It told users "your money is safe, and we're covering every loss." Daniel Tunkel of the law firm Edwin Coe said whether customers can recover losses would "come down to what [customers] have been promised in their contracts."
Bitcoin fell 5% to $76,800 in New York trading on Friday. Coinbase shares fell 12%, and Robinhood shares fell 7.8%.