An ongoing investigation by Binance has uncovered multiple points of compromise by hackers whose identities remain unknown, following a cyberattack on the world’s largest cryptocurrency exchange that has caused estimated losses of $6.3bn.

Binance said the security breach was more complex than initially thought, pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and the company’s own funds, and confirmed that it had already frozen assets worth around $3bn. Withdrawals are expected to resume within 45 hours, according to the company, while deposits have not been affected.

Binance’s latest statement in full:

“Our initial investigation indicated that the security incident may have involved a compromised laptop. However, further investigation has revealed additional points of compromise.

“This was a sophisticated attack, and we are doing everything possible to resolve the issue in cooperation with law enforcement authorities. We continue to gather evidence and will provide further information as it becomes available.

“Binance will cover all losses through the Secure Asset Fund for Users (SAFU) and the company’s own funds. User funds are safe.

“We remain on schedule to resume withdrawals within 45 hours. Deposits have not been affected.

“Outflows of funds were halted when we temporarily suspended withdrawal services. We are working closely with our partners to freeze many of the affected assets, having already frozen approximately $3bn.

“We will continue to provide updates through Binance’s official channels as more verified information becomes available.”

Binance announced earlier on Friday that an investigation into the incident was under way. The attack may have been linked to a breach of a laptop belonging to an engineer on the company’s DevOps team, potentially allowing the perpetrator to submit unauthorised withdrawal requests.

However, Binance co-chief executive Richard Teng later clarified that the attack involved a sophisticated process and was not the result of the simple abuse of an individual employee’s privileges. He stressed that the investigation had not identified any specific individual as responsible and that there was no evidence that private keys for digital wallets had been leaked.

Withdrawals suspended as crypto firms mobilise

Binance temporarily suspended withdrawals, revoking the relevant authorisations for affected addresses and upgrading its security systems. Deposits, according to the company, were unaffected and continue to operate normally.

Binance co-founder Yi He said the platform was working to strengthen its withdrawal services and the associated address checks, estimating that a phased resumption could begin within the next 48 hours.

The company is also cooperating with law enforcement authorities and specialist blockchain analytics firms to trace and recover the funds.

Other companies in the sector have joined efforts to freeze the assets. Circle chief executive Jeremy Allaire said the company had frozen more than $800m linked to the incident. Tether chief executive Paolo Ardoino similarly reported that more than $1.5bn had been frozen.

Ripple also announced that it was taking steps to freeze funds linked to the incident that were held in its own stablecoin.

North Korean hacking group under scrutiny

Blockchain analytics firm TRM Labs linked the attack to TraderTraitor, a North Korean hacking group.

According to the company, the scale of the funds involved makes the incident the largest cryptocurrency theft on record.

The suspected involvement of North Korea brings to mind a series of major cyberattacks targeting cryptocurrency exchanges and other digital asset platforms.

Last year, North Korean hackers stole $1.5bn worth of cryptocurrency from the Bybit exchange.

According to data from Chainalysis, cryptocurrency thefts attributed to North Korean hackers totalled $2bn in 2025, an increase of 50% compared with the previous year.

These incidents highlight the persistent threat facing the industry, despite major platforms’ investments in cybersecurity.

Cryptocurrency markets come under pressure

Binance’s announcement added to the pressure on cryptocurrency markets. Bitcoin fell by more than 4% on Friday, dropping to $76,000 and reaching its lowest level since mid-September. Other digital assets, including Ether, Solana and XRP, also recorded losses.

Meanwhile, positions worth approximately $1.3bn that had bet on rising cryptocurrency prices were liquidated over a 24-hour period, ahead of the expiry of $11bn worth of options contracts on the Deribit platform.

Attacks on digital asset platforms remain a recurring risk for the industry. In 2025, Bybit suffered losses of around $1.5bn in a cyberattack, while more recently, Bitget lost more than $350m worth of digital assets in a cryptocurrency theft.