What we know so far about the Binance hack

Technology reporter

Crypto is a type of digital asset which does not exist physically like cash or coins. Instead, people use digital wallets on their smartphones or computers to access and manage it.

Richard Teng, Binance's co-chief executive officer, said it is working with the authorities to work out what has happened and it will cover all losses.

What is Binance?

Binance is the world's largest cryptocurrency exchange by trading volume, where people can buy, sell and trade digital currencies, like Bitcoin, as well as deposit and withdraw them.

The exchange has come under scrutiny over the past few years - notably in 2023, when its then-chief executive, Changpeng Zhao, resigned after pleading guilty to money laundering violations.

In 2024, the company said it has more than $160bn in assets.

How did the hack happen?

Binance.us, which provides trading services specifically for US residents, said it has not been affected by the issue.

"That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions."

Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean an engineer was "talked into taking a test" and malware - malicious software – "landed on their laptop while they did it".

Because the laptop already had sufficient security privileges, Nandakumara said early reports suggest it became "the attacker's route straight into production, and from there to the wallets".

"You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened," said Dr Clive Summerfield, head of FARx, a biometrics in AI security company.

Who is behind the hack?

It is not yet known who is behind the attack, but some analytics firms have pointed to North Korea - though this has not been confirmed.

AI-powered investigations company TRM Labs said in a report several elements of the Binance attack resembled earlier incidents linked to the territory, including a $1.5bn (£1.1bn) hack on the ByBit exchange in 2025.

These previous attacks have been linked to a cluster of cyber-criminals accused of working directly for the regime called the Lazarus Group - also known as TraderTraitor.

North Korea has always denied any involvement in these attacks; Binance has not directly responded to BBC queries about the incident's potential links to the area.

What does it mean for Binance users?

He said the firm would cover all losses from its emergency reserve set up for such situations, and make up the rest with company funds.

"We are still on track towards the expected timeline to resume the withdrawal service in 45 hours," it said.

Marijus Briedis, NordVPN's chief technology officer, said people should be on the lookout for things such as "an email claiming your funds are at risk", "a fake support account offering help" or "a message urging you to move your cryptocurrency to a 'safe' wallet".

"Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase."

What does this mean for cryptocurrency and the wider financial system?

Jennifer Craven, an international commercial fraud expert at the law firm Pinsent Masons, said the repercussions of the hack could "extend well beyond Binance".

"If a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what that means for smaller, less mature platforms and currencies."

Although there is no evidence yet that AI was used in this attack, it fits into a much wider concern in the financial industry of whether AI agents could potentially identify weaknesses in software and work out how to exploit them much faster than human hackers.

How many people use cryptocurrency?

Crypto has become an increasingly popular way of investing and transferring money online, partly because, unlike traditional currencies, it is not controlled by central banks or governments.

According to Solcard, a crypto-funded prepaid payment and virtual card platform, somewhere between 560 million and 741 million people own crypto worldwide in 2026.