Jack Burgess
Live reporter

Image source, Reuters

"Cyber warfare is very much a tool in North Korea’s arsenal," North Korean foreign policy expert Dr Edward Howell, from the University of Oxford, tells me.

The author of A New Axis of Upheaval: North Korea, Russia, China, Iran says that, as of the current day, "around 40 to 50% of North Korea’s weapons of mass destruction programmes is funded by cyber and crypto-currency warfare".

Howell says the North Korean regime will "do everything and anything it can to get cash".

"We’ve got to remember that North Korea basically has a state-run cyber warfare agency," he says, adding that the infamous Lazarus group - also known as TraderTraitor - "is likely behind this Binance attack".

North Korea has never admitted being behind the Lazarus Group, but in 2020 the US added North Koreans accused of being part of the Lazarus Group to its Cyber Most Wanted list.

This is the biggest hack in history and probably the biggest single theft of any kind, our cyber correspondent Joe Tidy says. He talks you through the key details in less than a minute - watch below:

It is difficult to get a sense of how many people worldwide own crypto, although it has attracted significant interest in recent years.

• Around 8% of adults in the UK own cryptoassets, according to the latest research from the Financial Conduct Authority
• Around 8.7% of the US population owns them, according to the Securities and Exchange Commission
• In the euro area, around 9.7% of people (or someone in their household) own cryptoassets, according to a 2024 survey of select countries carried out by the European Central Bank

Data from official sources is not readily available for all countries, including India and China.

It's also worth bearing in mind that some people have minimal exposure - just 'dabbling' for fun - while others invest more significant amounts.

Of course, not everyone who trades crypto will use Binance - the company which has been hacked.

It is, however, a significant player, describing itself as "the largest crypto exchange by trade volume" with an average daily volume of $95bn (£71bn). It is estimated to have more than 300 million registered users worldwide.

Binance has insisted user funds are safe, adding that it will cover all losses.

However, the impact of the incident goes beyond just those who use the platform, with the Bitcoin price having dropped by around 5%.

Joe Tidy
Cyber correspondent

All eyes are on the value of Bitcoin. The famous green or red line dictating how much a single bitcoin is worth acts like a barometer for how healthy the entire industry is.

And right now it is holding up, only losing $3,000 (£2,200) since it started falling from $80,000 (£59,700) when the hack was announced.

Some are saying this shows how resilient bitcoin has become. Previous hacks and major events have seen the coin value tank.

However, it's important to note that Binance, and some other exchanges and networks, have frozen all trading whilst they deal with the hack.

So it remains to be seen how the value will go once people are able to actually buy or sell their crypto.

Liv McMahon
Technology reporter

Image source, Getty Images

This isn't the first time Binance has been hacked, or had to suspend withdrawals - it's had to do that several times before and in various markets in response to impacts on its operations or regulatory decisions.

The world’s largest crypto exchange disclosed a “large scale” breach in May 2019 after hackers stole cryptocurrency then valued at $41m (£31m).

Binance said hackers stole 7,000 bitcoins in one go - now worth around $400m - and it suspended withdrawals for several days.

It said the attackers had used a variety of techniques to break in - including viruses and phishing attacks to access security information - and it begged users for their understanding.

The exchange also pledged to replace lost cash with the help of its Secure Asset Fund for Users (Safu) – an emergency insurance fund.

Binance has taken similar actions and made similar pledges to users today, after suffering what may be the largest-ever hack of its kind.

Tara Mewawalla
Live reporter

Image source, Getty Images

The world's biggest crypto exchange Binance says it has "begun recovering affected assets for users", after it was hit by what is thought to be the biggest hack in history.

Cryptocurrency worth $6.3bn (£4.7bn) was stolen in the mega-hack, and trading on platform Binance Alpha was temporarily suspended last night - read a timeline of Binance's response here.

In its latest update, the firm reiterated that it has committed to cover losses through company funds, and says it has reserved over $6.3bn (£4.7bn) to cover the incident.

It said frozen or protected assets remain subject to ongoing recovery and verification. Earlier, it said $3bn (£2.24bn) had already been frozen.

The initial investigation suggests the incident may have begun with a "compromised DevOps engineer's laptop", Richard Teng, Binance's co chief executive says, but adds that it's a "complex attack".

We don't know who is behind the attack but analysts have pointed to North Korean hacking unit TraderTraitor. Why North Korea? Crypto theft is a big money-maker for the regime, our Japan correspondent writes.

Binance says it is working with law enforcement to find the criminals, though our senior technology reporter Shiona McCallum says investigators' efforts to follow the money could take months.

How did the attack happen? What is Binance? Our live reporter answers the seven major questions in our earlier post.

Liv McMahon
Technology reporter

Image source, Getty Images

The UK’s financial regulator, the Financial Conduct Authority (FCA), says it is aware of the Binance hack.

“While Binance wasn't registered with the FCA to provide crypto services in UK, we’re aware of the reported incident and engaging with them to understand the impact,” a FCA spokesperson says in a statement.

The FCA doesn’t regulate cryptocurrencies in the same way it does traditional finance products.

But firms and exchanges which advertise or sell crypto-assets must comply with some of its rules.

In 2021 it warned it had imposed requirements on Binance’s UK arm and, as such, Binance could not carry out any “regulated activity” without FCA approval.

Binance is not registered or authorised with the FCA and stopped accepting new UK retail customers in 2023. But existing users still access some services via its global platform.

Crypto theft is a big money-maker for North Korean regimepublished at 12:11 GMT

12:11 GMT

Kurumi Mori
Japan correspondent

Image source, EPA/Shutterstock

Several blockchain insiders and analysts are pointing the finger at Pyongyang-linked groups for the hack.

Remember, North Korean state-sponsored cyber crimes have increasingly focused on big-scale crypto thefts over the past years.

The regime has been repeatedly been accused of using cryptocurrency theft to generate revenue to help fund its weapons programmes.

In 2025, North Korean hackers are believed to have stolen at least $2.02bn (£1.5bn) in cryptocurrency, according to experts. Crypto theft is likely one of its biggest money-makers.

So if the losses are confirmed, this would be an unprecedented case when it comes to the sheer scale of cryptocurrency theft we've seen, and would also pressure the industry to step up its defences against future hacks.

For even more on the North Korea link, BBC World Service's podcast Cyber Hack: The Lazarus Heist dives deep into the secretive nation's sponsorship of hacking.

Liv McMahon
Technology reporter

Image source, Getty Images

Cryptocurrencies are digital currencies which, unlike the British pound, US dollar and Euro, are not controlled by centralised financial institutions. Fans call this difference financial freedom, but crypto is typically acquired through exchanges, like Binance, and can be regulated or unregulated depending on where you live.

Digital currencies and assets are underpinned by blockchains – technology which records and accounts for transactions of a virtual currency on a shared digital ledger. Transactions are arranged as blocks linked together in a giant chain (hence the name).

Bitcoin is the largest and most popular cryptocurrency.

New coins are created through a process called mining, whereby a global network of miners use specialised computers capable of solving complex calculations to verify transactions to add them to its blockchain. Those that do so successfully are rewarded with Bitcoin. But unlike other popular cryptocurrencies such as Ethereum, Bitcoin’s supply is capped – and eventually no further Bitcoins will be able to be created.

Because of this scarcity, many fans and investors consider it to be a particularly valuable digital asset and immune to traditional market activity. But its price can plummet as quickly as it can skyrocket, and its fluctuations often trigger a domino effect across the crypto market more broadly.

See our explainer for more meanings of key crypto terms.

Jacob Phillips
Live reporter

In our last post, we explained that it could take months for investigators to follow the money. We can bring you a bit more now on what the hackers are likely to do next.

A cyber-security expert says that Binance has already stopped around half of the money involved in the hack from being moved again but it is "unlikely" to physically get back the rest of the funds.

Earlier the company said it had managed to freeze around $3bn (£2.24bn) of assets.

Jake Moore, Global Cybersecurity Advisor at software company ESET, tells me the cyber attackers will be "trying to create red herrings" and turn the stolen funds into other cryptocurrencies through a process called "washing".

He tells me the attackers will be transferring the money thousands of times using different techniques to disguise the funds and make it impossible to trace.

"[The cyber attackers will be] spending the next year or so trying to lose that trail," he says. "Once they are confident the trail has been lost they will pop it out somewhere and it can be used - in their eyes - legitimately."

Moore says law enforcement's best chance of finding the funds will be if it is turned into normal currency, even if this is years later.

He explains there have been stories in the past of cyber attackers being caught three or four years after a crime when cryptocurrency is turned into sterling.

Moore says this is the "best chance" that it can be attributed to those who had it.

Following the stolen money could take monthspublished at 11:34 GMT

11:34 GMT

Shiona McCallum
Senior technology reporter

This theft may have happened quickly, but efforts to recover the cryptocurrency could continue for much longer.

Joe Hancock, head of cyber risk and complex investigations at law firm Mishcon de Reya, says he expects a prolonged laundering process: "Laundering will likely take place over weeks or months if not longer.

"Assets that can be frozen will be disposed of first, followed by a potential consolidation into Bitcoin and a movement off chain via a range of brokers or underground banking."

The public transaction records may help investigators follow the money, but tracing it and recovering it remain separate challenges.

"Crypto is a big target for hackers. The nature of crypto as an electronic currency makes these kind of transfers easier to execute and hard to reverse. It’s also hard to recover funds unless it hits an off-ramp from the crypto ecosystem such as an exchange," Hancock said.

An off-ramp is a service through which cryptocurrency can be converted into conventional money (such as pounds, dollars, or euros) and transfers the cash into the real-world financial system. Such services can offer investigators an opportunity to intervene.

Meanwhile, Binance’s promise to reimburse customers creates a separate financial test. Frozen assets still need to be returned, and any money that cannot be recovered must be replaced.

Confidence will depend on Binance demonstrating that it has met those obligations and that customers can actually withdraw.

Joe Tidy
Cyber correspondent

A lot of the fear right now from Binance users - and the crypto industry at large - is whether or not Binance will actually be capable of covering this enormous financial loss.

The company has said repeatedly that customer funds will be covered and that the firm is strong enough to weather the storm.

But crypto history watchers have been pointing out online that this is exactly the kind of message that FTX CEO Sam Bankman-Fried gave before his crypto exchange collapsed in 2022, leading to huge losses for customers and the industry.

Elon Musk replied to someone making this point on X with a worried face emoji.

But Binance founder Changpeng Zhao, known widely by his initials CZ, fired back at the billionaire and former Bitcoin fan saying: "Elon, have a lot of respect for you, but bad time to troll. Please stop."

CZ added that Binance helped Musk buy Twitter with $500m and said that Binance’s investment alone is worth more than a billion dollars.

"Would appreciate if you show a little support. Thanks!”

Musk has not replied.

Image source, X

More now from Binance's latest update.

The firm reiterates that it has "already publicly committed to cover losses through company funds".

It says it has already reserved over $6.3bn (£4.7bn) - the same amount that was stolen in the hack - to cover this incident, Binance says $5bn of these funds "already held in the exact token assets that were impacted".

It says it is completing the purchase of the remaining amount by buying assets through various channels. "This step can take longer," it says, adding that it will share progress "as soon as we can".

It explains that these figures do not include frozen assets, which "remain subject to ongoing recovery and verification".

Earlier, it said $3bn had been frozen.

Binance has just issued another update on X, saying it has "begun recovering affected assets for users".

It adds that it continues to work with law enforcement and other partners to "trace, freeze and recover additional funds".

We'll bring you more in our next post.

Image source, Getty Images

Binance has told investors it will cover all losses from the hack and reassures traders that their funds are safe.

But if you're an individual crypto investor not using a well-trusted exchange, how can you protect your money?

In the UK, the Financial Conduct Authority (FCA) regulates financial services companies but it warns that "most crypto-related activities are not regulated".

It goes on to say crypto is often highly volatile, subject to sudden market moves and at risk of cyber attacks with a stark warning that if "you decide to invest in crypto then you should be prepared to lose all your money."

For those undeterred it suggests that any investments are part of a diversified portfolio.

Global data company Experian says storing your crypto in a safe place is key and there are a variety of "wallets" to choose from. That includes hardware wallets - a physical device - to keep your details offline when you're not trading.

Investors should also be vigilant about spotting phishing scams such as unsolicited texts, checking website URLs for authenticity and not being tempted by get rich quick schemes.

Katie Williams
Live reporter

Image source, Getty Images

Crypto giant Binance has insisted user funds are "safe" after being hit by a $6.3bn hack - suspected to be the largest known breach in history. Here's a recap.

• What is Binance? The world's biggest crypto exchange where users trade digital assets like Bitcoin
• How big is the attack? It's suspected to be the largest crypto hack on record, impacting $6.3bn. It's the latest in a series of attacks to hit the industry, including the $1.5bn Bybit hack in 2025
• Who's behind it? We don't yet know but analysts have pointed to North Korean hacking unit TraderTraitor. Binance says it is "working closely" with law enforcement to identify the criminals
• How did it happen? Binance says its initial investigation suggested the incident may have involved a "compromised laptop", but adds that further digging "uncovered additional points of breach"
• What has Binance said? It insists "user funds are safe" and says it will cover all losses. It says it is working with partners to freeze affected assets and has "frozen around $3 billion thus far"
• Impact for investors? The hack is a major blow to the crypto world, our cyber correspondent writes, with Binance claiming to control approximately 35% of the total crypto market share. Bitcoin dropped by 5% following the attack
• Remind me, what is crypto? Crypto is a type of digital currency not controlled by centralised financial institutions. It includes the likes of Bitcoin. It has a reputation for being volatile

Crypto market may be on cliff edge because of hackpublished at 10:28 GMT

10:28 GMT

Zoe Kleinman
Technology and AI editor

So far cryptocurrency values aren't tumbling dramatically, but that could well be because lots of assets are frozen while Binance investigates what has happened.

Other platforms are also locking themselves down to minimise risk, in case it's a hack that could be exploited more widely and affect them as well.

Binance says it might be 45 hours before it unfreezes everything - at which point Bitcoin and other currencies may find themselves once again on the edge of a rather steep cliff in terms of value, if their owners are spooked by the incident and decide to ditch them.

Cyber security stories seem to be rarely out of the headlines at the moment. Two months ago a group of 100 tech companies signed an open letter warning the world to prepare itself for a new era of cyber resilience.

That letter has already turned out to be quite the prophecy.

Image source, Reuters

Latest hack comes at end of what some have dubbed 'Black October'published at 10:13 GMT

10:13 GMT

Liv McMahon
Technology reporter

Image source, Reuters

It’s been a month for the cyber-security community, with a spate of incidents – chiefly the high-profile vulnerabilities recently exposed using AI – some have dubbed "Black October".

One developer working to help patch systems after flaws were surfaced in server-side programming language PHP last week told the BBC it's been "relentless".

But even prior to that incident, October had already seen a flurry of hacks.

Early in the month, French supermarkets were hit by an attack which caused fridges and freezers to heat up, spoiling food estimated to be worth millions of euros.

And days before that, Asos app users received a notification sent by hackers revealed to have gained access to the online fashion retailer’s systems, turning its app into their "ransom note".

There’s still a lot we don’t know about the Binance hack and, with speculation about North Korean involvement, it would appear to be entirely different to the kind of breaches we’ve been alerted to in recent weeks.

But it nonetheless comes at the end of a busy October – a month which each year is used to champion cyber-security awareness.

Jacob Phillips
Live reporter

Image source, Getty Images

Binance first announced that it was investigating a security issue on Thursday evening. By Friday morning the estimated impact had passed $6bn (£4.47bn).

We've pieced together a timeline based on what the crypto trader has said so far - here's what to know:

Thursday

21:29 GMT Binance says it is "actively investigating" a potential security issue but reassures users that their funds are "completely safe".

22:33 It says its team is conducting security checks and that withdrawals will resume "as soon as the security issue is fully resolved". It repeats that user funds remain safe.

23:06 Trading on platform Binance Alpha is temporarily suspended.

23:22 Binance says it has frozen $2.54bn (£1.89bn) in assets and explains the figure may increase as it works closely with law enforcement, issuers, blockchain intelligence firms and industry partners.

Friday

00:13 Binance announces it will cover all loses and that as a precaution all deposits and withdrawals have been temporarily suspended.

00:52 Binance announces that the total frozen assets have risen to around $3bn (£2.24bn).

02:25 Binance says its initial investigation suggests the security incident may have involved a "compromised DevOps engineer's laptop" which allowed the hackers to gain access and submit unauthorised transactions. It says the estimated impact is around $6.3bn (£4.7bn).

07:37 Richard Teng, Binance's co-CEO, reassures users: "Your money is safe and we're covering every loss." He says the hack "was not a simple 'one click' action" but a "more complex attack process". He says that the investigation has not "attributed responsibility to any individual".

08:47 Binance says it has uncovered additional "points of breach" as well as the compromised laptop. It says it is on track towards resuming withdrawal services in 45 hours.

Image source, Getty Images

A survey carried out for the Financial Conduct Authority (FCA) in August 2024, suggested that approximately 12% of British adults owned crypto-assets - equivalent to about seven million people.

Globally, it has been estimated that more than half a billion people are now crypto owners. But as ownership rises, so does theft. The pandemic ushered in a surge in the value of crypto coins and with it an explosion in attacks on the industry.

Most of the money is being stolen in massive cyber attacks on crypto companies like the latest hack on Binance. And in February 2025, North Korean hackers swiped $1.5bn (£1.1bn) from crypto exchange Bybit.

The losses in this case and the vast majority of others are covered by the deep-pocketed crypto firms, with little impact on individuals. But there has been an increase in the number of attacks on individual crypto investors.

Chainalysis research says these individual attacks rose from 40,000 in 2022 to 80,000 in 2025.

Hacking, scamming or coercing of individuals accounted for an estimated 20% of all crypto value stolen - estimated at $713m (£532m).

But the company adds that the number could be far higher as not all victims will choose to report thefts publicly. When this happens, you could be left on your own.

Read more about cryptocurrency security in Joe Tidy's investigation here.