Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday.

The attackers compromised several systems, including a Binance engineer’s laptop, before accessing a privileged system that allowed them to make the massive withdrawals, the company said in multiple social media posts.

“We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far,” Binance added. It promised to cover all of the losses.

Binance has suspended withdrawals and deposits while it investigates the theft. The company said it was working with law enforcement on the investigation, and both the FBI and the U.S. Secret Service confirmed their involvement to Cybersecurity Dive.

The FBI said in a statement that it was “aware of the incident” and was “engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”

Tom Lynch, a spokesperson for the Secret Service’s Washington Field Office, said investigators from the agency “are working around the clock” with partners “to identify, freeze, trace, and recover” the funds stolen in the attack. Lynch said the agency is also coordinating with federal prosecutors “to identify the cyber criminals responsible and bring them to justice.”

The elite North Korean hacking team TraderTraitor was responsible for the Binance intrusion, according to cryptocurrency analysis firms TRM Labs and Chainalysis.

“Several features of this attack match earlier North Korea-linked heists,” TRM Labs researchers wrote in a blog post, “including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.”

The hackers began laying the groundwork at least 36 hours before the thefts began, according to TRM Labs, which described several test runs that involved moving money between hacker-controlled wallets.

It took roughly 20 minutes for the attackers to steal most of the money, TRM Labs said.

A coalition of blockchain analysis companies and other cryptocurrency firms worked together to trace and freeze roughly half of the stolen money, which “shows an industry increasingly able to act quickly, both independently and together,” Chainalysis researchers wrote.

North Korea has a long history of stealing cryptocurrency to fund its weapons programs. TRM Labs said in April that two groups linked to Pyongyang were responsible for three-quarters of all cryptocurrency hack losses in the first quarter of 2026. Chainalysis said last December that North Korea stole $2 billion in cryptocurrency in 2025, roughly 50% more than its 2024 total.

Until the Binance hack, the largest cryptocurrency theft on record was North Korea’s $1.5 billion breach of the ByBit exchange.