Binance said Thursday that a security incident affected about $6.3 billion in assets and that partners had frozen nearly $3 billion on-chain, according to ABC News and The Hacker News^4,5.

The exchange temporarily suspended deposits and withdrawals, said it found no evidence that wallet private keys leaked, and pledged to cover losses from its Secure Asset Fund for Users and company funds^1,4,5.

Binance said an initial investigation suggested a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, a more complex process than a single engineer's permissions, The Hacker News and RTE News reported^2,4.

Tether and Circle froze more than about $1.57 billion in USDT and $800 million in USDC tied to the incident, outlets said, with Ripple freezing roughly $200 million^1,4,6.

Blockchain firms TRM Labs and Chainalysis attributed the theft to North Korean actors with high confidence, RTE News and The Hacker News reported; TRM linked tradecraft to the group it calls TraderTraitor and to earlier Bybit and KelpDAO incidents^2,4.

Chainalysis estimated about $5.91 billion stolen at the time of the theft and said funds from last month's Bitget exploit commingled with Binance proceeds, according to CNBC and The Hacker News^3,4.

TRM's Ari Redbord told CNBC that issuer freezes can stop stablecoins quickly but that returning assets typically requires court process, and that roughly $2.4 billion in bitcoin and ether remained beyond issuer freeze tools³.

Binance said it expected to resume withdrawals within 48 hours after revamping withdrawal services and that it would publish a technical post-mortem; North Korea's missions did not immediately comment, RTE said^2,4,5.

Bitcoin fell several percent after the alerts, the BBC and CNBC reported^1,3.

Independent confirmation of the North Korea attribution, the status of unfrozen assets, and a full root-cause account from Binance remained outstanding^2,4.