Cryptocurrency exchange Binance confirmed on Friday that it suffered a massive security breach resulting in the theft of more than $6 billion in digital assets, an incident that would be the largest cryptocurrency hack on record. The company said it had reserved over $6.34 billion in company funds to cover the losses and was actively working to recover assets for its users.

Initial investigations by Binance suggested a single compromised laptop may have been involved, but further examination revealed multiple points of breach, indicating a more complex attack. The stolen funds were moved across ten different blockchain networks, mostly within a 20-minute span.

Blockchain analysis firms have pointed to a North Korean hacking group known as TraderTraitor as the likely perpetrators behind the heist. TRM Labs, a U.S.-based blockchain intelligence company, expressed “high confidence” in attributing the attack to this elite group, which is believed to be associated with the Lazarus Group — a hacking collective known for a series of high-profile cyberattacks, including the 2014 Sony Pictures hack. Another analytics firm, Elliptic, has also aligned with this assessment.

Binance has said it is cooperating closely with law enforcement agencies to confirm the identities of those responsible and to bring them to justice. The company has been posting regular updates on social media about the ongoing investigation and recovery efforts. Co-CEO Richard Teng emphasized the company’s commitment to resolving the matter promptly.

U.S. President Donald Trump, speaking from the White House, acknowledged the incident and said that authorities were investigating possible North Korean involvement but had yet to reach a definitive conclusion. Trump stated that U.S. officials were “looking at that” as part of their inquiry.

Experts note that North Korea has increasingly turned to cybercrime, including cryptocurrency theft, to generate foreign currency amid international sanctions and economic hardships. South Korea’s spy agency estimated that North Korean hackers have stolen over $1 billion in digital assets over the past five years, with a significant portion attributed to 2022 alone.

While Binance and partners have reportedly frozen approximately half of the stolen assets—around $3 billion—there are concerns that the hackers are actively attempting to launder and convert the remaining funds. Cryptocurrency analysts explain that stolen assets are often mixed through services known as tumblers or mixers to obscure their origins, making recovery and tracking more difficult.

The investigation into the breach remains ongoing as Binance and law enforcement agencies continue to work toward recovering the assets and identifying the culprits behind the complex cyberattack.