Cryptocurrency platform Binance said Friday it was working to resolve a “complex attack” that affected around $6.3 billion in funds, with roughly half that amount frozen to prevent a massive theft.

The company—the world’s largest crypto exchange by daily trading volume—said investigations had “uncovered additional points of breach,” contrary to initial findings suggesting the hack involved a single compromised laptop. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance wrote on X.

The firm earlier posted a series of sometimes contradictory messages, insisting that “user funds are completely safe” while also saying it would “cover all losses.” On its Latin America X account, the company confirmed that “the total estimated impact is around $6.3 billion”—four times the amount involved in the largest-ever cyberattack of its kind, the $1.5 billion taken from the Bybit platform in February last year.

Binance warned the figure “may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.” It said around $3 billion in affected assets had already been frozen.

The 2023 Bybit heist was attributed at the time to a hacker group affiliated with North Korea called TraderTraitor. Blockchain investigation firm TRM Labs said Thursday it had “high confidence” that the Binance hack was also orchestrated by TraderTraitor, citing “robust on and off-chain intelligence” and noting that “several features of this attack match earlier North Korea-linked heists.” TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking Sony Pictures in retaliation for The Interview, a film mocking North Korean leader Kim Jong Un.

Fund Freeze and Withdrawals

At about 0900 GMT Friday, Binance said it was on track to resume withdrawals within 45 hours, after announcing earlier that all deposits and withdrawals had been “temporarily suspended.” It added that “deposits remain unaffected.”

The company had said on X that its initial investigation suggested the hack involved a compromised laptop belonging to a “DevOps engineer,” allowing an unauthorised party to access a “service container” and execute unauthorised withdrawal transactions. “We have found no evidence of any private key leaks from wallets,” it said, promising a detailed technical analysis once investigations were complete. It later said “subsequent investigation has uncovered additional points of breach.”

Paolo Ardoino, CEO of Tether—which issues the USDT cryptocurrency—said his firm froze about $1.6 billion “related to a potential Binance exchange hack.” Jeremy Allaire, who runs cryptocurrency platform Circle, said his company had frozen more than $800 million in USDC. Both USDT and USDC are “stablecoins,” digital currencies whose value is pegged to the US dollar.

The US Department of Justice and the FBI did not immediately respond to requests for comment.

Crypto Prices Tumble

For several hours before Binance confirmed the attack, industry observers said hackers had managed to reach the platform. Prices of most major cryptocurrencies fell on the news, except for stablecoins, which by definition can only fluctuate within tight margins. Bitcoin and Ethereum plunged nearly five percent and nearly six percent respectively, while BNB, native to Binance, tumbled nearly 10 percent.

The attack comes as many observers express worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols.