Binance is investigating a security breach estimated to have cost $6.3 billion, in what could become one of the largest cryptocurrency thefts on record, after attackers allegedly exploited a compromised employee device to execute unauthorised withdrawals.

The world’s largest cryptocurrency exchange by trading volume said its initial investigation points to a compromised laptop belonging to a DevOps engineer, which may have allowed attackers to access a service container and submit unauthorised withdrawal transactions.

Blockchain intelligence firms have attributed the attack with high confidence to TraderTraitor, a North Korean hacking operation linked to the Lazarus Group. The FBI has also attributed responsibility to North Korea and TraderTraitor, although individual hackers have not been publicly identified. The group has previously been associated with major cryptocurrency thefts targeting exchanges and blockchain platforms.

Binance said it had found no evidence that wallet private keys were exposed, but estimated the total financial impact at approximately $6.3 billion.

The exchange has worked with blockchain partners, including stablecoin issuers Tether and Circle, to freeze approximately $3 billion of the affected assets, representing nearly half of the estimated losses.

Binance said it would absorb all losses using its Secure Asset Fund for Users (SAFU) and corporate funds, insisting that customer balances remain protected.

As an immediate response, Binance temporarily suspended deposits and withdrawals while conducting security checks, revoked the affected address authorisation and engaged law enforcement and blockchain intelligence firms to trace and recover the stolen funds.

The incident raises fresh questions about the security of cryptocurrency exchanges, particularly the risks posed by compromised employee devices and privileged access to internal infrastructure.

Binance said it would publish a detailed technical post-mortem after completing its investigation and release an updated Proof of Reserves once remediation work is finished.

Bitcoin fell below $77,000 while Ethereum dropped under $2,200 following reports of the incident, adding pressure to an already sensitive cryptocurrency market. Binance has pledged to work with law enforcement to identify those responsible and pursue the recovery of the stolen assets.