NEW YORK, United States (AFP) — Cryptocurrency platform Binance said Friday it was working to resolve a “complex attack” that affected around US$6.3 billion in funds, in what is thought to be the biggest ever crypto heist, with investigators pointing to hackers linked to North Korea.

Blockchain investigation firm TRM Labs said it had “high confidence” that the attack was orchestrated by a North Korea-affiliated group called TraderTraitor, the same group blamed for the US$1.5 billion theft from the Bybit platform in February last year.

Another analytics firm, Elliptic, also attributed the attack to North Korea-linked hackers, according to industry outlet CoinDesk.

TraderTraitor is believed to be part of Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong Un.

Binance, the world’s largest crypto exchange by daily trading volumes, said investigations had “uncovered additional points of breach”, contrary to initial findings that suggested the hack involved a single compromised laptop.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance wrote on X.

The company confirmed on its X account for Latin America that “the total estimated impact is around US$6.3 billion,” four times the amount taken in the Bybit hack, the biggest cyberattack of its kind until now.

Binance warned the figure “may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets”.

It said around US$3 billion in affected assets had been frozen.

Customers’ account balances have not been touched, but they cannot move funds off the platform while withdrawals remain suspended.

Binance initially suspended all deposits and withdrawals but later said deposits were unaffected. At about 0900 GMT Friday, it said it was on track to resume withdrawals in 45 hours.

The company had said on X that initial investigation suggested the hack involved a compromised laptop belonging to a “DevOps engineer”, allowing the unauthorized party to execute unauthorized withdrawal transactions.

“We have found no evidence of any private key leaks from wallets,” it said, promising to share a detailed technical analysis once investigations were complete.

The unauthorised withdrawals drained Binance’s hot wallets — the online wallets the exchange uses to process customer transfers — across several blockchains, according to CoinDesk.

Binance earlier posted a series of sometimes contradictory messages, insisting that “user funds are completely safe” but also saying it would “cover all losses”.

Paolo Ardoino, the boss of Tether, a company that issues a cryptocurrency known as USDT, said his firm froze about US$1.6 billion “related to a potential Binance exchange hack”.

Jeremy Allaire, who runs cryptocurrency platform Circle, said his company had frozen more than $800 million in USDC.

USDT and USDC are both “stablecoins” or digital currencies whose value is linked to a traditional currency, the US dollar.

The US Department of Justice and the FBI did not respond to requests for comment.

For several hours before Binance confirmed the attack, industry observers said hackers had managed to reach the platform.

The prices of most major cryptocurrencies fell on news of the cyberattack, except for the stablecoins, which by definition can only fluctuate within tight margins.

Bitcoin plunged nearly five per cent after the news, falling overnight to around US$76,400, its lowest level since mid-September, before recovering slightly to trade at about US$77,300.

Ethereum dropped nearly six per cent, while BNB, native to Binance, tumbled nearly 10 per cent.

The attack on Binance comes as many observers express worries that the ever-expanding capabilities of artificial intelligence (AI) models could compromise cryptography and IT security protocols.