Binance has recovered about $3bn of the $6.3bn in cryptocurrency stolen in a major cyberattack, as the exchange works with international law enforcement agencies to trace the remaining funds and identify those responsible.
The cryptocurrency exchange, the world’s largest by trading volume, said it had secured nearly half of the stolen digital assets, although a significant portion remained under the control of unidentified hackers.
The attack, described by the company as complex, is believed to be the largest cryptocurrency heist on record, surpassing the $1.5bn stolen from rival exchange Bybit in 2025.
The United States Secret Service said it was working to identify, freeze, trace and recover the stolen funds.
The agency also pledged to identify the cybercriminals responsible and bring them to justice, while Binance confirmed that it was collaborating with the Federal Bureau of Investigation.
Although Binance said its US-facing exchange was not affected, the involvement of US-linked assets, including dollar-pegged stablecoins issued by Tether and Circle, could bring American authorities into the international investigation.
Binance initially suspected that hackers had compromised an engineer’s laptop to facilitate unauthorised withdrawals. However, its subsequent investigation pointed to multiple points of breach.
The company’s co-chief executive, Richard Teng, said the attack was not the work of a single individual.
He explained that the hackers deployed a self-destruct mechanism that erased their tools and traces during the operation, making it more difficult for investigators to establish how the breach occurred.
Binance initially suspended deposits and withdrawals following the incident but later said deposits remained unaffected.
The exchange also assured customers that their funds were safe and pledged to cover all losses.
In a subsequent update, the company said it had set aside more than $6.34bn in its own funds to cover the stolen assets and was actively purchasing various cryptocurrency tokens.
The incident unsettled cryptocurrency markets, with Bitcoin falling by five per cent to $76,800 in Friday afternoon trading in New York.
Shares of cryptocurrency exchange Coinbase dropped by 12 per cent, as investors also reacted to its earnings report, which showed revenue slightly below expectations.
Robinhood, a financial services company that offers cryptocurrency trading, also recorded a 7.8 per cent decline.
Founded in China in 2017, Binance allows users to trade digital assets and has more than 300 million registered users worldwide.
The company said in 2024 that it held more than $160bn in assets under its custody.
Also Read:Â INTERPOL nets two Nigerian suspects over $2.4m fraud case
Despite Binance’s assurances that it would cover the losses, the scale of the breach has raised questions about the company’s ability to absorb the financial impact.
Some cryptocurrency users and industry observers have compared the exchange’s assurances to statements made by former FTX chief executive Sam Bankman-Fried before his company collapsed in 2022, leaving customers with substantial losses.
Legal experts have also cautioned customers against assuming that Binance’s promise to reimburse losses automatically creates a legally enforceable obligation.
Daniel Tunkel of London-based law firm Edwin Coe said customers’ ability to recover their funds would depend on the terms of their contracts with the exchange.
He noted that the issue could eventually involve legal action if Binance failed to meet its obligations.
Binance has faced regulatory scrutiny in several countries over its operations and compliance with financial regulations.
Meanwhile, cryptocurrency investigations firm TRM Labs said several elements of the attack resembled previous cyber incidents linked to North Korean hacking groups, including the 2025 Bybit breach.
Blockchain analytics firm Chainalysis also said it had high confidence that a North Korean actor was linked to the latest attack.
The cryptocurrency industry has suffered billions of dollars in losses from cyberattacks over the past five years, with investigators repeatedly pointing to hacking groups suspected of operating on behalf of North Korea.
One of the groups frequently linked to such incidents is the Lazarus Group, also known as TraderTraitor.
Analysts have accused the group of targeting cryptocurrency platforms to generate funds for the North Korean regime, which faces extensive international sanctions and has limited access to global financial systems.
North Korea has consistently denied involvement in cybercriminal activities.
However, blockchain transaction analysis and accounts from defectors have been cited by investigators as evidence of the country’s alleged involvement in cryptocurrency theft.
BBC News
