DUBAI — Binance has put the cost of a security breach at its exchange at about $6.3 billion, saying an attacker reached its systems through a compromised staff laptop and submitted unauthorised withdrawals in what blockchain analysts describe as the largest cryptocurrency theft on record.

The company suspended withdrawals on multiple networks late on Thursday and said it would make customers whole out of its own reserves. Bitcoin fell 4.8 per cent to below $77,000, CoinDesk reported, while ether lost 5.7 per cent and Binance's own BNB token dropped about 8 per cent.

The loss dwarfs the roughly $1.5 billion taken from the exchange Bybit in 2025, until now the industry's worst single theft. It has also stopped withdrawals at a venue that held about $144 billion in assets before the breach, according to the data site DefiLlama, which would make the stolen sum close to 4 per cent of the total.

That matters in the Gulf, where Binance has built a regulated base. Its Dubai arm, Binance FZE, has held a full virtual asset service provider licence from the emirate's Virtual Assets Regulatory Authority since April 2024, Gulf Business reported at the time, allowing it to serve institutional and qualified investors as well as retail traders.

Binance said its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop". The exchange added: "We have found no evidence of any wallet private key leak."

Chief executive Richard Teng gave a more complicated account on Friday. The attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action", he said, adding: "Our investigation has not attributed responsibility to any individual." Binance said it had since found additional points of breach, Decrypt reported.

In an emailed statement on Thursday, the company said it was "aware of reports of a potential security issue and are actively investigating" and told customers: "Rest assured that user funds are completely safe." A Binance spokesman, Ross O'Leary, said the exchange had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure", TechCrunch reported.

Binance said it would cover all losses from the Secure Asset Fund for Users, an emergency reserve that holds roughly $1 billion in bitcoin, together with company money. Teng said deposits were operating as normal by Friday morning.

Changpeng Zhao, who founded Binance and remains its largest shareholder but no longer runs it, wrote on X that "it does look like a hack on Binance" and that "user funds are safe". He said he expected customers to be fully covered.

The recovery effort has run through the companies that issue dollar-pegged tokens. Tether's chief executive, Paolo Ardoino, said his firm had frozen more than $1.567 billion of USDT. Jeremy Allaire, who runs Circle, said it had frozen more than $800 million of USDC.

Jack McDonald, Ripple's senior vice-president for stablecoins, said in a statement that his company was "closely monitoring reports of a potential exploit involving Binance and its attackers' RLUSD holdings". Decrypt put Ripple's freeze at about $200 million. Yi He, Binance's co-chief executive, thanked the Ripple team on X "for promptly freezing approximately 200 million".

Binance said about $3 billion of the affected assets had been frozen on the blockchain. How much is beyond reach is not yet clear. Arkham Intelligence, which tracks wallets using public blockchain data, put the haul at $6.01 billion drained from Binance hot wallets across nine blockchains on Thursday afternoon in New York, and said issuers had frozen $2.80 billion of it. Chainalysis put the figure at about $5.9 billion at the time of the theft, according to CoinDesk.

Investigators have pointed to North Korea. TRM Labs said it assessed with high confidence that the attack was the work of the hacking unit it calls TraderTraitor. The blockchain investigator known as ZachXBT named the Lazarus Group as the likely attacker, CoinDesk reported. Ido Ben-Natan, co-founder and chief executive of the security firm Blockaid, told CoinDesk the tactics and sophistication seen so far were consistent with operations run from Pyongyang, and called the episode "the biggest crypto hack in history". Binance has not named a suspect.

"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," Ari Redbord, TRM's global head of policy, told Al Jazeera.

Sean Foley, who studies crypto markets at Macquarie University in Sydney, told the same outlet that the episode showed the hazard of leaving holdings with an intermediary. "Any assets held at a centralised exchange are only as safe as the exchange itself," he said.

Thefts on this scale are not new, though none has come close to this one. Earlier this year Bitget lost more than $350 million, Liquid Network about $320 million and Drift $295 million, CoinDesk reported, citing DefiLlama. TRM Labs counted $2.87 billion stolen across nearly 150 incidents during 2025.

Separately on Thursday, the prediction market Polymarket briefly halted trading after a third-party supplier was compromised. TechCrunch reported that about $2 million in customer funds was taken through software built by the firm DebugBear. Polymarket said it had fixed the problem and would reimburse affected users.

Binance said it would publish a detailed technical post-mortem once its investigation is complete. Withdrawals remain suspended, and the company said on Friday it was on track to restore them within 45 hours.