The company’s co-CEO Richard Teng says initial investigations point to a “compromised DevOps engineer’s laptop” giving hackers access, with a follow-up statement from Binance saying it’s “uncovered additional points of breach”

Teng also tells customers their “money is safe, and we’re covering every loss.”

How to keep your crypto investments safe

Binance has told investors it will cover all losses from the hack and reassures traders that their funds are safe.

But if you’re an individual crypto investor not using a well-trusted exchange, how can you protect your money?

In the UK, the Financial Conduct Authority (FCA) regulates financial services companies but it warns that “most crypto-related activities are not regulated”.

It goes on to say crypto is often highly volatile, subject to sudden market moves and at risk of cyber attacks with a stark warning that if “you decide to invest in crypto then you should be prepared to lose all your money.”

For those undeterred it suggests that any investments are part of a diversified portfolio.

Global data company Experian says storing your crypto in a safe place is key and there are a variety of “wallets” to choose from. That includes hardware wallets – a physical device – to keep your details offline when you’re not trading.

Investors should also be vigilant about spotting phishing scams such as unsolicited texts, checking website URLs for authenticity and not being tempted by get rich quick schemes.

Seven questions answered following crypto mega-hack

Crypto giant Binance has insisted user funds are “safe” after being hit by a $6.3bn hack – suspected to be the largest known breach in history. Here’s a recap.

• What is Binance? The world’s biggest crypto exchange where users trade digital assets like Bitcoin
• How big is the attack? It’s suspected to be the largest crypto hack on record, impacting $6.3bn. It’s the latest in a series of attacks to hit the industry, including the $1.5bn Bybit hack in 2025
• Who’s behind it? We don’t yet know but analysts have pointed to North Korean hacking unit TraderTraitor. Binance says it is “working closely” with law enforcement to identify the criminals
• How did it happen? Binance says its initial investigation suggested the incident may have involved a “compromised laptop”, but adds that further digging “uncovered additional points of breach”
• What has Binance said? It insists “user funds are safe” and says it will cover all losses. It says it is working with partners to freeze affected assets and has “frozen around $3 billion thus far”
• Impact for investors? The hack is a major blow to the crypto world, our cyber correspondent writes, with Binance claiming to control approximately 35% of the total crypto market share. Bitcoin dropped by 5% following the attack
• Remind me, what is crypto? Crypto is a type of digital currency not controlled by centralised financial institutions. It includes the likes of Bitcoin. It has a reputation for being volatile

Crypto market may be on cliff edge because of hack

So far cryptocurrency values aren’t tumbling dramatically, but that could well be because lots of assets are frozen while Binance investigates what has happened.

Other platforms are also locking themselves down to minimise risk, in case it’s a hack that could be exploited more widely and affect them as well.

Binance says it might be 45 hours before it unfreezes everything – at which point Bitcoin and other currencies may find themselves once again on the edge of a rather steep cliff in terms of value, if their owners are spooked by the incident and decide to ditch them.

Cyber security stories seem to be rarely out of the headlines at the moment. Two months ago a group of 100 tech companies signed an open letter warning the world to prepare itself for a new era of cyber resilience.

That letter has already turned out to be quite the prophecy.

Latest hack comes at end of what some have dubbed ‘Black October’

It’s been a month for the cyber-security community, with a spate of incidents – chiefly the high-profile vulnerabilities recently exposed using AI – some have dubbed “Black October”.

One developer working to help patch systems after flaws were surfaced in server-side programming language PHP last week told the BBC it’s been “relentless”.

But even prior to that incident, October had already seen a flurry of hacks.

Early in the month, French supermarkets were hit by an attack which caused fridges and freezers to heat up, spoiling food estimated to be worth millions of euros.

And days before that, Asos app users received a notification sent by hackers revealed to have gained access to the online fashion retailer’s systems, turning its app into their “ransom note”.

There’s still a lot we don’t know about the Binance hack and, with speculation about North Korean involvement, it would appear to be entirely different to the kind of breaches we’ve been alerted to in recent weeks.

But it nonetheless comes at the end of a busy October – a month which each year is used to champion cyber-security awareness.

How Binance has responded to the hack so far – a timeline

Binance first announced that it was investigating a security issue on Thursday evening. By Friday morning the estimated impact had passed $6bn (£4.47bn).

We’ve pieced together a timeline based on what the crypto trader has said so far – here’s what to know:

21:29 GMT Binance says it is “actively investigating” a potential security issue but reassures users that their funds are “completely safe”.

22:33 It says its team is conducting security checks and that withdrawals will resume “as soon as the security issue is fully resolved”. It repeats that user funds remain safe.

23:06 Trading on platform Binance Alpha is temporarily suspended.

23:22 Binance says it has frozen$2.54bn (£1.89bn) in assets and explains the figure may increase as it works closely with law enforcement, issuers, blockchain intelligence firms and industry partners.

00:13 Binance announces it will cover all loses and that as a precaution all deposits and withdrawals have been temporarily suspended.

00:52 Binance announces that the total frozen assets have risen to around $3bn (£2.24bn).

02:25 Binance says its initial investigation suggests the security incident may have involved a “compromised DevOps engineer’s laptop” which allowed the hackers to gain access and submit unauthorised transactions. It says the estimated impact is around$6.3bn (£4.7bn).

07:37 Richard Teng, Binance’s co-CEO, reassures users: “Your money is safe and we’re covering every loss.” He says the hack “was not a simple ‘one click’ action” but a “more complex attack process”. He says that the investigation has not “attributed responsibility to any individual”.

08:47 Binance says it has uncovered additional “points of breach” as well as the compromised laptop. It says it is on track towards resuming withdrawal services in 45 hours.

Crypto theft rises as digital currency becomes more popular – what it means for you

A survey carried out for the Financial Conduct Authority (FCA) in August 2024, suggested that approximately 12% of British adults owned crypto-assets – equivalent to about seven million people.

Globally, it has been estimated that more than half a billion people are now crypto owners. But as ownership rises, so does theft. The pandemic ushered in a surge in the value of crypto coins and with it an explosion in attacks on the industry.

Most of the money is being stolen in massive cyber attacks on crypto companies like the latest hack on Binance. And in February 2025, North Korean hackers swiped $1.5bn (£1.1bn) from crypto exchange Bybit.

The losses in this case and the vast majority of others are covered by the deep-pocketed crypto firms, with little impact on individuals. But there has been an increase in the number of attacks on individual crypto investors.

Chainalysis research says these individual attacks rose from 40,000 in 2022 to 80,000 in 2025.

Hacking, scamming or coercing of individuals accounted for an estimated 20% of all crypto value stolen – estimated at $713m (£532m).

But the company adds that the number could be far higher as not all victims will choose to report thefts publicly. When this happens, you could be left on your own.

Beware criminals using hack to scam other crypto platforms, experts warn

Experts often warn that in the confusion following cyber-attacks, different hackers may also seek to exploit the situation with scams on other crypto platforms.

Marijus Briedis, NordVPN’s chief technology officer, says people should be on the look out for things such as “an email claiming your funds are at risk”, “a fake support account offering help” or “a message urging you to move your cryptocurrency to a ‘safe’ wallet”.

“Check updates through the Binance app or a website address you already trust,” he says. “Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase.”

And if you are feeling pressure to act immediately, he says, that should be a reason to pause to verify the request.

Binance hack a major blow to crypto world

Binance is the largest cryptocurrency exchange globally, controlling approximately 35% to 36% of the total crypto market share as of mid-2026 – according the firm.

It is seen as a pillar of the crypto industry inspite of previous controversy.

In November 2023, Binance pleaded guilty to anti-money laundering and sanctions violations, agreeing to pay a $4.3bn (£3.2bn) settlement to the US Department of Justice.

Prosecutors determined the exchange deliberately disguised the locations of US customers to evade regulations, which allowed transactions linked to illegal drug trades, child exploitation, and terrorism to flow through the platform.

Binance’s high profile founder Changpeng Zhao stepped down as CEO and was sentenced to four months in US prison.

In spite of the episode, Binance continued to grow and is a foundational part of the crypto world.

The firm’s public statements suggest it can handle the enormous losses and make sure customers funds are replaced.

But even still, if Binance’s security team were unable to stop hackers, other exchanges and companies will be scrambling to make sure they are not next.

Binance attack dwarfs past known crypto hacks

This latest hack is thought to be the biggest ever.

In nearly all previous cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group – also know as TraderTraitor.

It’s still not known who’s behind the Binance attack – but fingers are once again pointing towards North Korea, which has always denied wrongdoing.

Binance attack dwarfs past known crypto hacks

What to know about how crypto works

Crypto is a type of digital currency and does not exist as paper bills or metal coins; they exist as electronic data entries.

Unlike traditional currencies, they are not controlled by centralised financial institutions.

This makes it popular for people who think decentralisation can bring financial freedom, but it also makes it extremely volatile with it rising and falling in value at the whim of buyers and sellers.

Blockchain is the technology underpinning all cryptocurrencies.

In essence, it is a virtual spreadsheet on which all the buying and selling of crypto is recorded. They are arranged in blocks linked together in a giant chain – hence the name.

Every cryptocurrency transaction is individually recorded onto the blockchain by a huge network of volunteers verifying its authenticity by using computer programmes.

Binance investigation finds ‘additional points of breach’

We can now bring you the latest update from Binance about the hack.

The crypto exchange says that while its initial investigation suggested the incident may have involved a “compromised laptop”, further digging has “uncovered additional points of breach”.

No further details about the breaches are offered, but Binance says it will continue to provide updates about the investigation.

It goes on to say that “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.

“We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.”

The exchange adds that it is working with its partners to freeze affected assets and has “frozen around $3 billion thus far.”

Bitcoin value drops 5% after Binance hack

Bitcoin – the original cryptocurrency – has dropped about 5% in value to roughly $76,400 (£56,900), according to multiple reports.

That’s its lowest value in a month, says the AFP news agency. It’s not the only cryptocurrency to suffer: Bloomberg reports that the Ether, Solana and XRP tokens also fell.

Cyber security expert warns other financial institutions could be at risk

This is thought to be the largest crypto hack on record, but the reason it stands out is because of how it was carried out, according to expert Jayant Dave from cyber security firm Check Point.

“The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign,” he says.

He says Binance’s early findings point to one compromised engineer’s laptop, with attackers using it to reach a service that could submit withdrawals, moving billions “within minutes”.

“That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it,” Dave says.

He says it’s not just crypto companies that are exposed to this risk. He says that banks or other institutions with automated systems that move money or data on instruction face the same risk.

In the last five years the crypto industry has been beset by enormous losses from hackers.

Each year seems to see a more devastating hack, with crypto exchanges often the target.

In nearly all cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group – also know as TraderTraitor. The names refer to clusters of cyber criminals accused of working directly for the regime.

North Korea is an impoverished country with very little industry and heavy international sanctions and experts say the regime uses cyber crime as a way to bring money in.

North Korea has always denied this, but the wealth of evidence from cryptocurrency flow analysis and insider interviews from defectors is compelling. It makes North Korea likely to be the only nation that uses hacking as a way to raise public funds.

Hack ‘unprecedented in its scale’, cyber security expert tells BBC

Emily Taylor, co-founder of the Global Signal Exchange, an organisation that helps prevent scams and other forms of cyber crime, has been speaking to BBC Radio 4’s Today programme.

She says that the financial losses set a “grim new record”, but also says this hack was conducted “on a speed and scale we’ve never seen”.

“It also highlights very much our dependence on technology,” she adds. “The way that we do money these days is different to how we did it 10, 20, 30 years ago.”

Taylor says a signature technique for hackers to gain access to systems is to lure people with very responsible engineering jobs with fake job adverts.

They then go on to persuade them to download a test or other software which compromises their computer.

“So if you think of an engineer with a very responsible job in a situation like Binance, they will have a very wide-ranging ability to go all over the system to make withdrawals and so on because they’re responsible for keeping the system safe.”

This hack eclipses record-setting $1.5bn hack on Bybit exchange

This latest hack targeting Binance is thought to be the largest in history and eclipses a previous attack on the Bybit exchange in 2025.

In the 2025 incident, hackers thought to be working for North Korea – in a network known as Lazarus Group, also referred to as TraderTraitor by the US government – swiped $1.5bn (£1.1bn).

Within around two weeks of the attack, they had managed to successfully convert at least $300m into unrecoverable funds.

In a post on X in August this year – 18 months after the attack – Bybit co-founder Ben Zhou said the company had been “working on recovery from every possible angle” and had recovered around $48.4m, with another $30.5m “frozen”.

He added that the exchange had also filed a civil lawsuit against North Korea and the Lazarus Group.

AI-powered investigations company TRM Labs has said that several elements of the latest Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.

‘We’re working closely with law enforcement’: Full statement from Binance co-chief

Here’s the full statement from Richard Teng, Binance’s co-CEO:

“I want to speak to you directly about what happened. Bottom line – your money is safe, and we’re covering every loss.

“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.

“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.

“We’ll share a detailed technical post-mortem once the investigation is complete and every fact is verified – and publish an updated Proof of Reserves once remediation is complete.

• Your funds are safe
• Binance will cover all losses from the SAFU fund and company funds
• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
• No evidence of any wallet private key leak
• Deposits are unaffected and operating as normal

• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
• Revoked the affected address authorizations
• Engaged law enforcement and blockchain intelligence partners to trace and recover funds

“Our team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately – and I’ll share what I can, as soon as I can.”