Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea

Image source, Getty Images By Jaroslav Lukiv and Joe Tidy , Cyber correspondent, BBC World Service Published 30 October 2026, 16:03 GMT Updated 1 hour ago Binance, the world's largest cryptocurrency exchange, says it has frozen around half of the funds stolen in a "complex" hack, after $6.3bn (£4.7bn) was accessed in what is believed to be a record heist.

The firm said $3bn of its stolen digital assets had been secured - but many were still in the hands of unidentified hackers. It initially thought an engineer's laptop had been compromised, allowing unauthorised withdrawals, but later said the attack was wider.

Several analytics firms have linked the hack, which eclipses a $1.5bn (£1.12bn) heist on the Bybit exchange in 2025, to a North Korean hacking unit.

The US Secret Service said it was "working around the clock" "to identify, freeze, trace, and recover" stolen funds.

America's lead federal agency for investigating financial crimes added that it would "identify the cyber criminals responsible and bring them to justice", while Binance also said it was working with the FBI.

While Binance said its US-facing exchange was unaffected, the US would still have jurisdiction to investigate the hack and help track down stolen funds - an effort which generally involves a global law enforcement effort.

The hack also involved some US-linked assets, such as stablecoins Tether and Circle – cryptocurrencies pegged to the dollar.

Binance told its users "your money is safe, and we're covering every loss".

It had initially suspended all deposits and withdrawals - but then said in an update that "deposits remain unaffected".

Who could be behind the Binance hack and what we know so far

Binance's co-CEO Richard Teng said: "This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."

Teng also describes how the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate".

Initially, the company had indicated the breach "may have started with a compromised DevOps engineer's laptop" but later statements have pointed to a broader breach.

Binance, which was founded in China in 2017, allows users to trade digital assets and is estimated to have more than 300 million registered users worldwide.