Hackers steal $6.3 bil. from Binance in record heist blamed on North Korea

Hackers stole $6.3 billion from Binance in a breach that analysts blamed on North Korea, prompting the exchange to halt withdrawals and say it would cover the losses. Binance said customer funds were safe and that it had located about $3 billion of the stolen assets with partners. The attack unfolded mostly within about 20 minutes late Thursday, and cryptocurrency prices fell before markets stabilized. Binance said it expected to resume withdrawals within 48 hours.

Binance said it had set aside around $6.34 billion in company funds to cover the losses, and its website describes a separate $1 billion bitcoin reserve fund for protecting customer assets during security breaches.

Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.

Binance co-CEO Richard Teng said the attack involved a compromised laptop and malicious software designed to erase traces, and that hackers manipulated a transaction-approval system to move funds from an internet-connected wallet.

Bitcoin fell to a six-week low of $76,368, ether dropped more than 3 percent to a two-month low of $2,178, and BNB was down 6.2 percent over 24 hours at $702.

Binance had 335 million registered users globally and about $162.8 billion in assets under custody, according to its 2025 annual report.

Published Oct 30, 2026 1:33 pm KST

Updated Oct 31, 2026 12:55 am KST

Representations of cryptocurrencies are seen in front of displayed Binance logo in this illustration taken Nov. 10, 2022. Reuters-Yonhap

SINGAPORE/HONG KONG — Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a theft that analysts blamed on North Korea and said could be the largest financial heist of all time.

Cryptocurrency prices fell on the news, while Binance halted withdrawals and said it would use company funds to cover the losses. Stablecoin issuers including El Salvador-based Tether and the Trump-backed World Liberty Financial froze about half of the stolen assets.

The exchange said customer funds were safe and it was working with partners to freeze some of the affected assets, with about $3 billion located so far. It said earlier on Friday it expected to resume withdrawal services in the next 48 hours. It did not mention the status of the remaining $3.3 billion.

Binance said it had set aside around $6.34 billion of company funds internally to cover the losses. The company has a $1 billion bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website. Binance founder Changpeng Zhao said on X that the company owned SpaceX shares worth more than $1 billion.

"We NEVER use any customer funds, so they are not impacted," Binance co-CEO Richard Teng said in a post on X.

Teng described the breach as a "complex attack" that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete traces and evidence of its activity as it went along, "making it more difficult for us to trace and investigate."

The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected wallet in a way that did not pass through normal approval controls, Teng said.

Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.

'Biggest hack in history'

The incident adds to a string of crypto thefts. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.

The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to U.S. blockchain analysis firms TRM Labs and Chainalysis.

TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.

"TRM attributes the attack to ... North Korea's elite hacking unit," the firm said in an analysis on its website. Both TRM and Chainalysis said they were highly confident North Korea was responsible.

"This incident is almost certainly the single largest known theft of any kind," British blockchain analysts Elliptic said.

North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to U.S. and South Korean authorities as well as cybersecurity experts.

North Korea routinely denies that. Its mission in Geneva and embassy in China did not respond to requests for comment.

Binance is working with the Federal Bureau of Investigation and the United States Secret Service (USSS), a person familiar with the situation told Reuters.

The FBI said it was "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps."

The USSS did not respond to an emailed request for comment.

Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, said it was "engaging closely with Binance and monitoring the incident".

"It's the biggest hack in history," Aravind Srinivasan at market maker GSR said, as crypto prices fell broadly.

Bitcoin hit a six-week low of $76,368 and ether fell more than 3 percent to a two-month low of $2,178 before markets stabilised.

BNB, a token originally launched as Binance Coin that can be used to pay Binance fees, was down 6.2 percent over the past 24 hours at $702, according to CoinMarketCap, while shaky confidence hit listed crypto exchange shares.

Security implications

Beyond the potential loss of assets, the security breach was likely to have wider ramifications for the crypto sector, which had already been under pressure due to higher U.S. interest rates and softer demand from exchange-traded fund buyers, analysts said.

"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges," said Tim Sun, senior researcher at HashKey Group.

Investor Michael Saylor, among Bitcoin's most prominent supporters, said in a post on X that he expected Binance to "deliver" on ensuring no customers suffered losses. "Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient," he wrote on Friday.

Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report.

Abu Dhabi-backed investment group MGX became a minority investor in Binance last year. MGX declined to comment.

黑客从币安窃取了63亿美元，分析人士认为此次攻击与朝鲜有关，导致该交易所暂停提现并表示将弥补损失。币安称客户资金安全，并已与合作伙伴追回约30亿美元的被盗资产。此次攻击主要发生在周四晚间约20分钟内，加密货币价格一度下跌，之后市场趋于稳定。币安表示预计将在48小时内恢复提现。

币安表示，已拨出约 63.4 亿美元的公司资金来弥补损失，其网站还介绍了一个单独的 10 亿美元比特币储备基金，用于在安全漏洞期间保护客户资产。

Tether 表示已冻结与该事件相关的近 15.7 亿美元资产，而 Circle 则冻结了超过 8 亿美元。

币安联席首席执行官 Richard Teng 表示，此次攻击涉及一台被入侵的笔记本电脑和旨在抹除痕迹的恶意软件，黑客操纵了交易审批系统，将资金从一个联网钱包中转移出去。

比特币跌至六周低点 76,368 美元，以太坊下跌超过 3%，至两个月低点 2,178 美元，BNB 在 24 小时内下跌 6.2%，至 702 美元。

根据币安2025年年度报告，币安在全球拥有3.35亿注册用户，托管资产约1628亿美元。

发布于2026年10月30日下午1:33（韩国标准时间）

更新于2026年10月31日凌晨12:55（韩国标准时间）

这张摄于2022年11月10日的插图显示，加密货币的图案位于币安标志前。（路透社-韩联社）

新加坡/香港——黑客从全球最大的加密货币交易所币安窃取了 63 亿美元，分析人士将此次盗窃事件归咎于朝鲜，并称这可能是史上最大的金融盗窃案。

消息传出后，加密货币价格下跌，币安暂停了提现，并表示将动用公司资金弥补损失。包括总部位于萨尔瓦多的泰达币（Tether）和特朗普支持的世界自由金融公司（World Liberty Financial）在内的稳定币发行机构冻结了约一半被盗资产。

该交易所表示，客户资金安全，并正与合作伙伴共同冻结部分受影响资产，目前已找到约30亿美元。交易所周五早些时候表示，预计将在未来48小时内恢复提款服务。但交易所并未提及剩余33亿美元资产的状况。

币安表示，已从公司内部拨出约63.4亿美元资金用于弥补损失。据其官网显示，该公司还设有10亿美元的比特币储备基金，旨在保护客户资产免受安全漏洞的影响。币安创始人赵长鹏在X平台上透露，该公司持有价值超过10亿美元的SpaceX股份。

“我们绝不使用任何客户资金，因此他们不会受到影响，”币安联席首席执行官 Richard Teng 在 X 上发帖称。

滕将此次入侵描述为一次“复杂的攻击”，并非由一人实施，而是利用了被入侵的笔记本电脑以及旨在删除其活动痕迹和证据的恶意软件，“这使得我们更难追踪和调查”。

滕表示，黑客能够操纵用于批准交易的系统，将资金从币安控制的联网钱包中转移出去，而这种转移方式并未经过正常的审批控制。

稳定币发行商 Tether 表示，已冻结与该事件相关的近 15.7 亿美元资产，而 Circle 则冻结了超过 8 亿美元。

“史上最大黑客事件”

这起事件使加密货币盗窃案数量进一步攀升。据TRM Labs的研究人员称，去年攻击者通过近150起攻击窃取了价值29亿美元的加密货币。

据美国区块链分析公司 TRM Labs 和 Chainalysis 称，币安账户被盗事件的大部分发生在周四晚些时候开始的 20 分钟左右，与之前被归咎于朝鲜的大规模攻击有相似之处。

TRM表示，攻击者能够命令币安钱包中的资金转移到黑客控制的钱包中，这与2025年加密货币交易所Bybit遭遇的抢劫案类似，FBI将Bybit的抢劫案归咎于朝鲜。

TRM在其网站上发布的一份分析报告中称：“TRM将此次攻击归咎于……朝鲜的精英黑客部队。” TRM和Chainalysis都表示，他们高度确信朝鲜应对此负责。

英国区块链分析公司Elliptic表示：“这起事件几乎可以肯定是已知最大的单起盗窃案。”

据美国和韩国当局以及网络安全专家称，朝鲜多年来一直利用与国家有关联的网络部队进行间谍活动、金融盗窃和牟利。

朝鲜一贯否认这一点。其驻日内瓦代表处和驻华大使馆均未回应置评请求。

一位知情人士告诉路透社，币安正在与美国联邦调查局和美国特勤局合作。

美国联邦调查局表示，“已了解此事，并正在与相关的公共和私人合作伙伴合作，以了解该活动的范围，评估潜在影响，并协调适当的调查步骤。”

美国特勤局没有回复记者的邮件置评请求。

为币安颁发主要运营许可证的阿布扎比​​金融服务监管局表示，他们正在“与币安密切合作并监控该事件”。

“这是历史上最大的黑客攻击，”做市商 GSR 的 Aravind Srinivasan 表示，加密货币价格普遍下跌。

比特币跌至六周低点 76,368 美元，以太坊下跌超过 3%，跌至两个月低点 2,178 美元，之后市场趋于稳定。

据 CoinMarketCap 数据显示，最初名为 Binance Coin 的代币 BNB（可用于支付 Binance 手续费）在过去 24 小时内下跌了 6.2%，至 702 美元，与此同时，上市加密货币交易所的股票也受到市场信心动摇的影响。

安全影响

分析师表示，除了可能造成的资产损失外，此次安全漏洞还可能对加密货币行业产生更广泛的影响，该行业此前已因美国利率上升和交易所交易基金买家需求疲软而面临压力。

“这可能会进一步抑制风险偏好，并促使投资者重新评估在中心化交易所持有的资产的安全性，”HashKey Group 高级研​​究员 Tim Sun 表示。

比特币最著名的支持者之一、投资者迈克尔·塞勒(Michael Saylor)在X论坛上发帖称，他期望币安能够“兑现”承诺，确保没有客户遭受损失。他在周五写道：“我们的行业将从这次事件中吸取教训，加强安全措施，并变得更加强大和更有韧性。”

币安允许用户买卖和交易数字资产，截至其 2025 年年度报告显示，币安在全球拥有 3.35 亿注册用户，托管资产约为 1628 亿美元。

阿布扎比支持的投资集团MGX去年成为币安的少数股东。MGX拒绝置评。