Economy

North Korean hackers steal six billion dollars from Binance in record crypto heist

Exchange freezes assets with three billion located so far, co-founder promises to cover all losses

Images

Have you been affected by the Binance hack ? Photograph: Bloomberg/Getty Images Have you been affected by the Binance hack ? Photograph: Bloomberg/Getty Images theguardian.com

Binance, the world's largest cryptocurrency exchange, has been hit by a hack costing roughly $6.3 billion — an industry record, and among the largest thefts in financial history. Analysts attribute the attack to North Korean state-backed hackers. The exchange has frozen the affected assets, with about $3 billion located so far, and co-founder Yi He says the company will cover "all hacking losses".

The scale is unusual even for an industry accustomed to disappearing coins. Binance holds 335 million registered users globally, and a $6.3 billion hole touches not just retail balances but the assumption that centralized exchanges can custody assets at all. The exchange's promise to make users whole — while presumably welcome to those affected — puts the entire loss on Binance's own balance sheet, which raises the question of what a $6.3 billion write-down does to the solvency of a private company whose books no regulator audits.

North Korea's involvement, if confirmed, would make this less a criminal heist than a state revenue operation. Pyongyang's hacking units have for years been the country's most reliable export sector, laundering billions through crypto mixers and cross-chain bridges. Freezing $3 billion of the proceeds means little unless counterparties cooperate faster than the laundering network moves — a race the West has consistently lost.

For users, the practical lesson is the one the industry keeps relearning: an exchange is a counterparty, not a vault. When the vault gets robbed, whether the money comes back depends on one person's promise at a company headquartered wherever the regulations are weakest.

The Guardian is collecting accounts from affected users via an encrypted form, anonymously if preferred.