Binance promises to cover losses after $6.3bn crypto hack

What happened

Binance has pledged to meet all losses from a $6.3bn (£4.7bn) cryptocurrency theft, with customers facing a temporary halt to deposits and withdrawals at its global exchange. The attack is thought to be the largest cryptocurrency hack to date.

The company said about half the affected assets had been frozen through work with partners, although substantial holdings remained under the attackers’ control. It subsequently said efforts to retrieve the stolen cryptocurrency had started. Freezing assets restricts their movement; recovering them is a separate step towards returning them to their owner.

Richard Teng, Binance’s co-chief executive, said the business was investigating alongside the authorities. He assured customers that their funds were safe and said an emergency reserve would meet the losses, with Binance’s own money covering any remaining shortfall. That commitment puts responsibility for the financial loss on the exchange rather than its users.

The breach affected Binance.com, the company’s global centralised trading platform. Binance.us, which serves residents of the United States, said its operation was unaffected. The distinction matters because the two services cater for different markets: the announcement about the global exchange does not describe an outage across both platforms.

The background

Binance was established in China in 2017 and has grown into the largest cryptocurrency exchange measured by trading volume. Hundreds of millions of people worldwide have registered with it. Its services allow customers to buy and sell digital currencies, trade between them and move assets into or out of their accounts.

Cryptocurrency exists digitally rather than as physical notes or coins. People use wallets on computers and smartphones to access and manage their holdings. An exchange provides a marketplace for those assets, while a centralised service also places an operator between customers and functions such as trading and withdrawals.

The company’s size gives the incident significance beyond a single trading venue. In 2024, Binance said it held assets worth more than $160bn. That figure describes holdings at that time, rather than the size of the emergency reserve Teng has identified for meeting the cost of this theft.

Binance has also faced legal scrutiny. Changpeng Zhao, its chief executive at the time, stepped down in 2023 after admitting money-laundering violations. Last year, a US lawsuit accused the business of facilitating transfers worth millions of dollars to organisations designated as terrorist groups by the United States. Those accusations are separate from the security breach.

The wider market has expanded as people use crypto for investment and online transfers. Solcard, a provider of crypto-funded payment cards, estimates that between 560 million and 741 million people worldwide own cryptocurrency in 2026. Those estimates concern ownership across the sector, not the number of people affected by the Binance attack.

How the attackers gained access

Teng’s preliminary account points to a compromised laptop belonging to a DevOps engineer as the possible starting point. DevOps work connects software development with the systems that run it, making access permissions an important part of protecting the operational environment.

According to Teng, the intruder used that foothold to reach a service container and submit withdrawals without authorisation. A container is an environment used to run software. His description indicates an attack involving several stages, rather than a single action that immediately released the money.

Raghu Nandakumara, vice president of industry strategy at cybersecurity company Illumio, suggested one possible explanation was that an engineer had been persuaded to complete a test that installed malicious software. He said the laptop’s existing permissions could then have provided access to live systems and wallets. That is a possible route, not an established account of how the laptop was compromised.

Two analytics firms have linked the incident to a North Korean hacking unit. TRM Labs identified similarities with earlier attacks attributed to North Korea, including the $1.5bn (£1.1bn) theft from ByBit in 2025. Previous incidents have been associated with hackers known as the Lazarus Group, also called TraderTraitor, who are accused of working for the regime. No one has claimed responsibility for this attack; North Korea has consistently denied involvement in such thefts.

What people are saying

Dr Clive Summerfield, who heads the AI biometrics security company FARx, highlighted the danger of deception targeting people with privileged access. His assessment was that strong technical protection can be undermined if an attacker tricks someone who holds the means to enter a protected system.

Jennifer Craven, an international commercial fraud specialist at Pinsent Masons, said the consequences could reach other parts of the cryptocurrency industry. She expects the breach to intensify scrutiny of safeguards for both infrastructure and customers, with regulators considering what an attack on a major operator implies for smaller, less developed platforms.

Marijus Briedis, chief technology officer at NordVPN, warned that criminals could use the disruption to target customers of other exchanges as well as Binance. He identified messages alleging that funds were in danger, impersonated support accounts and requests to transfer cryptocurrency into supposedly secure wallets as warning signs.

Separately, the Bank of England has warned about the prospect of AI tools finding and exploiting software weaknesses faster than financial institutions can repair them. That concern relates to the broader security environment facing finance, rather than an attribution of this theft to AI. The immediate technical account from Binance centres on compromised access and unauthorised withdrawals.

What happens next

Binance has set out an expected 45-hour timetable for restoring withdrawals, saying it remains on course to meet it. The suspension was introduced as a precaution. For customers, the reopening of withdrawals is a different milestone from the completion of the investigation or the recovery of every stolen asset.

Work with partners to immobilise the cryptocurrency is another part of the response. Binance said around $3bn had been located during that effort. Identifying assets, preventing further transfers and bringing money back are distinct tasks, so a sum located during tracing should not be treated as an equivalent amount already returned.

Briedis advised users to obtain updates through the Binance app or a familiar, trusted web address. He also urged them to avoid links arriving in unsolicited messages and to keep passwords, verification codes and wallet recovery phrases private. A recovery phrase can provide access to a wallet, making its disclosure particularly dangerous.

Why this matters

For UK customers using Binance.com, the practical impact is an interruption to moving money into and out of the exchange. The sterling value of the theft—£4.7bn—also illustrates the scale of the security exposure at a service used to hold and trade digital assets.

The promise to cover stolen funds does not remove cryptocurrency’s investment risks. Unlike traditional currencies, crypto is not controlled by governments or central banks, and prices can move sharply as buyers and sellers change their positions. Protection against this theft and protection against a fall in market value are different things.