Reported by 1 source

The short version

  • Binance customers withdrew over $3.6 billion in assets after the exchange reopened following a historic cyberattack.
  • U.S. authorities have identified North Korea as the likely perpetrator of the breach, which compromised $6.3 billion in digital funds.
  • The company claims to have covered 95% of the stolen assets and promises full reimbursement for all losses linked to the incident.

Binance, the global leader in cryptocurrency trading, resumed normal operations on Sunday after suspending transactions due to a massive security breach. The reopening coincided with a significant outflow of capital as users reacted to the news. More than $3.6 billion worth of digital assets were withdrawn from the platform in the immediate aftermath. This surge represents a critical stress test for the exchange, which had halted all trading activities to contain the damage and investigate the intrusion.

The cyberattack itself is described by officials as the largest hack in history. The breach resulted in the compromise of approximately $6.3 billion in digital assets. While this figure is staggering, it constitutes only a small fraction of the total value held by the company. Binance reported holding more than $160 billion in customer assets in 2024, suggesting that the firm's overall liquidity remains intact despite the severe incident.

News Journal

Law enforcement agencies have moved quickly to attribute responsibility for the attack. The U.S. Federal Bureau of Investigation has accused North Korea of orchestrating the cyber operation. This attribution aligns with previous patterns where state-sponsored hacking groups from the region have targeted cryptocurrency platforms to generate revenue. The scale of this particular breach underscores the growing sophistication and reach of these elite hacker units.

Binance has taken steps to reassure its user base regarding financial liability. The company stated that it has already covered roughly 95% of the assets stolen during the breach. Management indicated that sourcing the remaining funds may take additional time but reaffirmed a commitment to covering all losses associated with the attack. This guarantee is central to maintaining trust in an industry where platform solvency is often questioned during crises.

Initial data from the exchange suggests that the panic-driven withdrawals are beginning to subside. Binance noted on social media that there was an initial spike in activity, which has since declined and is stabilizing as anticipated. The resumption of services for major cryptocurrencies, including Bitcoin and Ethereum, marks a key milestone in the recovery process. Additional features and services are expected to return in phases once comprehensive security checks are finalized.

The scope of the breach appears limited to Binance's global centralized exchange platform. The company clarified that its U.S.-facing platform was not affected by the security incident. This distinction is important for American users, who operate on a separate regulatory and technical infrastructure. The isolation of the breach to the international site helps contain the reputational damage within specific markets.

Preliminary investigations into how the hackers gained access point to a potential insider vulnerability. Binance suggested that early checks indicate the incident may have originated from a compromised laptop belonging to an engineer. This device allegedly provided attackers with the necessary credentials or access points to execute unauthorized transactions. If confirmed, this vector highlights the persistent risks associated with human error and endpoint security in large tech organizations.

The broader implications of this event extend beyond immediate financial losses. Cryptocurrencies exist solely as digital entries managed on computers and smartphones, making them entirely dependent on the security of the platforms that host them. Unlike physical cash, these assets cannot be recovered if lost to theft or fraud unless the custodian intervenes. Binance's ability to absorb this loss demonstrates a level of financial resilience, but it also raises questions about long-term risk management in the decentralized finance sector.

Founded in China, Binance now serves hundreds of millions of registered users worldwide. Its dominance in the market makes it a prime target for cybercriminals seeking high-value returns. The incident serves as a stark reminder of the vulnerabilities inherent in centralized exchanges. As the company works to restore full functionality, the focus will remain on securing user assets and preventing future breaches while navigating the complex geopolitical landscape surrounding cyber warfare.

Looking ahead, the stabilization of withdrawal rates is a positive sign for market confidence. However, the full extent of the breach's impact may not be clear until all services are fully restored and independent audits are completed. The attribution to North Korea also suggests that diplomatic and law enforcement responses will continue to evolve. For now, users are advised to monitor official communications from Binance regarding the phased return of services and any further updates on asset recovery efforts.

Sources behind this briefing

Go to the original reporting