HONG KONG - Hackers stole approximately $6.3 billion in digital assets from Binance in what researchers described as the largest cryptocurrency theft on record, forcing the world's biggest crypto exchange to suspend withdrawals and mobilize billions of dollars to reimburse users.

Binance said Friday that it had set aside more than $6.34 billion in company funds to cover the affected assets. About $5 billion was already held in the same tokens that were stolen, representing roughly 80% of the estimated loss, and the company said it was buying the remainder through market and over-the-counter transactions.

The exchange said approximately $3 billion of the stolen assets had been frozen on-chain through cooperation with token issuers, other exchanges, blockchain investigators and law enforcement. Frozen assets are not the same as recovered funds, and efforts to trace or reclaim the balance were continuing.

Binance initially said the incident may have begun with a compromised laptop used by a DevOps engineer, allowing an attacker to access a service container and submit unauthorized withdrawals. A later update said investigators had found additional points of breach. The company said it had found no evidence that private wallet keys were leaked.

The attack affected a Binance hot wallet, which remains connected to online systems so an exchange can process transactions quickly. Binance co-CEO Richard Teng said most customer assets are normally kept in offline cold wallets and moved into hot wallets when withdrawals are required.

Withdrawals were temporarily suspended while security teams revoked compromised permissions, isolated affected infrastructure and added new controls. Deposits and other services remained operational. Binance said it planned to begin restoring withdrawals in phases after security checks and promised a full incident report.

Blockchain intelligence firm TRM Labs estimated that an attacker moved about $6.36 billion across 10 blockchains, most of it in approximately 20 minutes. TRM attributed the attack with high confidence to TraderTraitor, a hacking operation linked by U.S. authorities to North Korea. Chainalysis also said the group was likely responsible.

That attribution has not been confirmed publicly by Binance or U.S. law enforcement. Asked Friday whether North Korea was involved, President Donald Trump said the United States was investigating. Binance said it was working with authorities to establish who carried out the attack.

North Korea has repeatedly been accused of using cryptocurrency theft to acquire foreign currency under international sanctions and to support its weapons programs. The FBI blamed TraderTraitor for the $1.5 billion theft from the Bybit exchange in 2025, which had been considered the largest crypto heist before the Binance breach.

The scale of the latest loss is extraordinary even by the volatile industry's standards. Binance said user balances would be fully covered, but its ability to make customers whole does not answer how attackers obtained authority to move assets so quickly or why the transaction controls did not stop them.

A digital system can move money faster than its defenses can react

Cryptocurrency is often promoted as a way to avoid dependence on traditional banks. In practice, millions of users place their assets with centralized exchanges that perform the same basic function as custodians, but operate across borders, blockchains and regulatory systems with far less uniform oversight.

The Binance attack exposes that contradiction. Blockchain records can make stolen funds visible in public, yet visibility does not prevent theft. Once assets leave through valid-looking transactions, attackers can divide them among chains, swap tokens and use services designed to obscure their path before companies or governments can coordinate a freeze.

Speed is an advantage for legitimate digital finance and for criminals. Moving $6.36 billion in about 20 minutes means approval systems, human review and emergency controls must work almost instantly. A reserve large enough to reimburse users is important, but it should be the last defense, not the principal reason customers remain protected.

If the North Korean attribution is confirmed, the case will also show how an authoritarian state can exploit open financial technology while rejecting the transparency and legal restraint expected inside democratic markets. Sanctions are weakened when a regime can steal digital assets at industrial scale and convert even a fraction into usable funds.

The answer is not to treat every crypto user as a criminal or to ban useful technology. It is to demand the safeguards expected of institutions that hold other people's wealth: separated authorization, limited hot-wallet exposure, independent audits, rapid incident disclosure and reserves that can be verified rather than merely promised.

Binance has accepted responsibility for covering the immediate loss. Its next obligation is to publish enough technical detail for customers and the wider industry to understand the failure without compromising recovery efforts. The darkest lesson would be to reimburse the money, declare the crisis closed and leave the same structural weakness available to the next attacker.