Binance says its $6.3bn hack involved more than a compromised laptop

What happened

Binance says its $6.3bn hack involved more than a compromised laptop, according to The Next Web and Silicon Republic. Binance now says a compromised laptop was not the only way in. Its investigation has “uncovered additional points of breach” in the attack that hit about $6.3bn of its assets on Thursday, the world’s largest crypto exchange said on Friday. Binance is a cryptocurrency exchange and finance company based in United Arab Emirates.

The attack has been linked to an elite North Korean hacking group. Data and security TRM Labs says most of the money in the Binance hack left in about 20 minutes, across ten blockchains, and blames North Korea.

Binance said in an investigation update on X that it will cover all losses and has frozen about $3bn so far.

Blockchain analytics firm TRM Labs puts the theft at $6.36bn in a report on the Binance hack. It calls it “the largest crypto theft on record” and attributes it to TraderTraitor, a North Korean state hacking unit.

The previous record was the $1.5bn taken from rival exchange Bybit in February 2025. Its first update , on Thursday night, said a compromised DevOps engineer’s laptop may have let an attacker into a service container to submit unauthorised withdrawals. A later service update said the incident “stems from multiple factors”, with the compromised computer a possible entry point.