Binance Reports $6.3 Billion Crypto Heist Tied to Compromised Laptop, Analysts Point to North Korean Hackers

Binance, the world’s largest cryptocurrency exchange by trading volume, disclosed that a coordinated cyberattack resulted in the loss of approximately $6.3 billion in digital assets, making it the biggest crypto theft on record.

The breach, according to Binance’s internal investigation, originated from a compromised laptop used by a member of its DevOps team. The device allegedly allowed attackers to gain privileged access to the platform’s internal systems, enabling the unauthorized movement of funds across multiple blockchain addresses.

Blockchain analytics firms quickly linked the flow of the stolen tokens to a series of addresses commonly associated with North Korean state-sponsored hacking groups. While Binance has not formally named a specific entity, the pattern of transaction routing and the technical signatures match previous operations attributed to the Lazarus Group, which has a documented history of targeting cryptocurrency platforms to fund the regime’s illicit activities.

Initial estimates released by Binance placed the outflow at up to $5.8 billion, but subsequent forensic analysis by independent researchers pushed the figure higher, arriving at the $6.3 billion total. The discrepancy reflects the difficulty of tracking funds that are rapidly split, mixed, and moved through privacy-focused protocols, a tactic frequently employed by sophisticated threat actors.

The incident arrives at a time when the broader crypto industry is under heightened regulatory scrutiny following a series of high‑profile hacks and fraud cases. Regulators in the United States, Europe, and Asia have been urging exchanges to strengthen cybersecurity controls and improve transparency around large transfers. Binance’s revelation underscores the challenges even the most well‑funded platforms face in defending against state‑backed cyber operations.

Binance has said it is working with law‑enforcement agencies across multiple jurisdictions and with private security firms to trace the stolen assets and recover the funds where possible. The exchange also announced plans to overhaul its internal security protocols, including stricter device management policies and enhanced multi‑factor authentication for privileged accounts. As the investigation continues, the crypto community will be watching closely to see whether any portion of the $6.3 billion can be reclaimed and how the industry adapts to mitigate future threats.