Who could be behind the Binance hack and what we know so far

Image source, Getty Images

ByLaura Cress

Technology reporter

Binance, the world's largest crypto exchange, has been hit by what is believed to be the largest crypto hack ever at $6.3bn (£4.7bn).

Crypto is a type of digital asset which does not exist physically like cash or coins. Instead, people use digital wallets on their smartphones or computers to access and manage it.

Richard Teng, Binance's co-chief executive officer, said it is working with the authorities to work out what has happened and it will cover all losses.

Here's what we know so far.

What is Binance?

Binance is the world's largest cryptocurrency exchange by trading volume, where people can buy, sell and trade digital currencies, like Bitcoin, as well as deposit and withdraw them.

It was founded in China in 2017 and has hundreds of millions of registered users worldwide.

The exchange has come under scrutiny over the past few years - notably in 2023, when its then-chief executive, Changpeng Zhao, resigned after pleading guilty to money laundering violations.

Last year, a lawsuit in the US accused the company of helping send millions of dollars to US-designated terrorist organisations.

In 2024, the company said it has more than $160bn in assets.

How did the hack happen?

The hack happened to Binance's global centralised exchange, Binance.com.

Binance.us, which provides trading services specifically for US residents, said it has not been affected by the issue.

In an initial announcement, Teng said: "Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop.

"That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions."

He said the hack "was not a simple 'one-click' action" but a "more complex attack process".

Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean an engineer was "talked into taking a test" and malware - malicious software – "landed on their laptop while they did it".

Because the laptop already had sufficient security privileges, Nandakumara said early reports suggest it became "the attacker's route straight into production, and from there to the wallets".

Teng has since said the hack was "not carried out by one person" and the hackers used sophisticated methods to hide their tracks, such as a "self-destruct mechanism".

"You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened," said Dr Clive Summerfield, head of FARx, a biometrics in AI security company.

Image source, Bloomberg via Getty Images

Image caption,

Binance co-chief executive officer Richard Teng speaks at a conference

Who is behind the hack?

It is not yet known who is behind the attack, but some analytics firms have pointed to North Korea - though this has not been confirmed.

AI-powered investigations company TRM Labs said in a report several elements of the Binance attack resembled earlier incidents linked to the territory, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025.

These previous attacks have been linked to a cluster of cyber-criminals accused of working directly for the regime called the Lazarus Group - also known as TraderTraitor.

North Korean foreign policy expert Dr Edward Howell, from the University of Oxford, has told the BBC that Pyongyang "has a long history of using cyber warfare to extract cash".

Howell said North Korea "basically has a state-run cyber warfare agency", which it uses "to fund its weapons of mass destruction programmes" and as a "slush fund" for its leader Kim Jong Un's regime.

Howell added that as of the current day "about 40 – 50% of North Korea's weapons of mass destruction programmes are funded by cyber and crypto-currency warfare".

North Korea has always denied any involvement in these attacks; Binance has not directly responded to BBC queries about the incident's potential links to the area.

What does it mean for Binance users?

In his earlier statement, Teng said Binance users' funds are safe and, as a precaution, all deposits and withdrawals had been temporarily suspended.

He said the firm would cover all losses from its emergency reserve set up for such situations, and make up the rest with company funds.

Binance said it had been working with partners to freeze the affected assets, with around $3bn reportedly located so far.

Teng said concerned users can check funds on their Binance accounts. Experts suggest doing so through the official app and website, and to reach out to the company's customer service with any questions.

Users from other crypto platforms have also been warned to be wary of hackers seeking to exploit the situation.

Marijus Briedis, NordVPN's chief technology officer, said people should be on the lookout for things such as "an email claiming your funds are at risk", "a fake support account offering help" or "a message urging you to move your cryptocurrency to a 'safe' wallet".

"Check updates through the Binance app or a website address you already trust," he said.

"Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase."

Image source, Getty Images

Image caption,

Binance.us said it had not been affected by the issue

What does this mean for cryptocurrency and the wider financial system?

Jennifer Craven, an international commercial fraud expert at the law firm Pinsent Masons, said the repercussions of the hack could "extend well beyond Binance".

"More broadly, the incident exposes the fragility of parts of the crypto ecosystem," she said.

"If a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what that means for smaller, less mature platforms and currencies."

She said the attack would likely accelerate scrutiny of how the sector protects both its infrastructure and its customers.

Although there is no evidence yet that AI was used in this attack, it fits into a much wider concern in the financial industry of whether AI agents could potentially identify weaknesses in software and work out how to exploit them much faster than human hackers.

The Bank of England has warned, external this could leave institutions struggling to fix vulnerabilities before attackers take advantage of them.

How many people use cryptocurrency?

Crypto has become an increasingly popular way of investing and transferring money online, partly because, unlike traditional currencies, it is not controlled by central banks or governments.

This makes it popular for people who think decentralisation can bring financial freedom.

But it also makes it extremely volatile, with it rising and falling in value at the whim of buyers and sellers.

According to Solcard, a crypto-funded prepaid payment and virtual card platform, somewhere between 560 million and 741 million people own crypto worldwide in 2026.