North Korea blamed for $6.3bn Binance hack⁠.

Binance said on Thursday that $6.3bn (£4.7bn) of digital assets had been hit by what is thought to be the biggest crypto hack on record¹. About half of those assets have been frozen, and the exchange says it will cover all losses¹. Deposits and withdrawals were suspended while its security teams checked and secured its wallet systems².

Two analytics firms, TRM Labs and Chainalysis, have attributed the attack to TraderTraitor, a North Korean hacking unit¹. TRM said the attackers targeted Binance wallets across 10 blockchains and siphoned most of the funds within 20 minutes³. The previous record was the $1.5bn taken from the Bybit exchange in 2025, which was also blamed on North Korea¹.

The way in was ordinary. Binance said its initial investigation suggested the breach began with a compromised laptop belonging to one of its engineers, which gave an attacker access to a service container where they submitted unauthorised withdrawals¹. Co-chief executive Richard Teng said it was not a single one-click action and that no wallet private key had been found to have leaked¹. The company has since said it found additional points of breach¹.

Check Point's chief information security officer, Jayant Dave, said the attack implied that attackers no longer need the vault keys, and instead target the systems and people with authority to use them¹. Moody's said the incident shows the risk concentration in large, centralised intermediaries, where the scale of assets held can amplify the damage of a single breach³.

Others moved to stop the money. Tether said it had frozen nearly $1.57bn of assets linked to the incident and Circle more than $800m². Bitcoin fell more than 3% to a six-week low of $76,368, and shares in Coinbase slid 4.8% in extended US trading². One payments chief said it is becoming very hard to counter hacks because AI can find vulnerabilities faster than they can be fixed².

One laptop, one bad day

Most of our readers hold no crypto, and the sources give no British regulator's view of the theft. The lesson that travels is the one Check Point drew. The attackers did not crack the safe. They went through a trusted engineer's machine to a system that was allowed to move money, and then moved it. Every company has a version of that: the finance login, the payments run, the admin account an agent or a contractor can reach.

The questions are dull and worth asking this week. Who and what can move money or data without a second pair of eyes? Which laptops can reach those systems? And if one of them were turned against you tonight, how long before anyone noticed? Binance had people watching, and the money still left in minutes.

Also today

• Amazon's cloud grows fastest in nearly five years

  Amazon's AWS sales rose 39.3% in the quarter, its fastest growth in nearly five years, but a cautious holiday forecast sent shares down more than 6% after hours⁴.

• A start-up with 15 staff and 150 AI agents

  The Guardian visits San Francisco start-ups where AI agents act as assistants and coders, including one firm with 15 people and roughly 150 agents, and finds tension with human colleagues⁵.

• Workers building Europe's datacentres report dangerous conditions

  An investigation by the Guardian and Investigate Europe found some workers building Europe's datacentres exposed to dangerous conditions and afraid to speak out, including an electrocution at a Google site in Belgium⁶.