Cryptocurrency exchange Binance has confirmed that it suffered a complex cyberattack affecting approximately $6.3bn in assets, with about half of the affected funds frozen to prevent a massive theft.

The company, the world’s largest cryptocurrency exchange by daily trading volume, said on Friday that investigations had uncovered additional security breaches, contradicting initial findings that suggested the attack involved a single compromised laptop.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance said in a post on X.

The company had earlier issued a series of sometimes contradictory statements, insisting that “user funds are completely safe” while also pledging to “cover all losses”.

Binance confirmed the estimated financial impact of the attack on its X account for Latin America, putting the figure at approximately $6.3bn.

The amount is more than four times the value of funds affected in the largest previously recorded cyberattack of its kind, in which $1.5bn was stolen from cryptocurrency platform Bybit in February last year.

Binance warned that the figure “may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets”.

It said approximately $3bn in affected assets had been frozen.

The 2023 Bybit heist was attributed at the time to TraderTraitor, a group of hackers affiliated with North Korea.

Blockchain investigation firm TRM Labs said on Thursday that it had “high confidence” that TraderTraitor was also responsible for the Binance attack, citing “robust on and off-chain intelligence”.

“Several features of this attack match earlier North Korea-linked heists,” TRM said.

TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking Sony Pictures in retaliation for The Interview, a film that mocked North Korean leader Kim Jong Un.

At about 0900 GMT on Friday, Binance said it was on course to resume withdrawals within 45 hours, after announcing earlier that all deposits and withdrawals had been “temporarily suspended”.

“Deposits remain unaffected,” the company said.

Binance had earlier stated on X that preliminary investigations suggested the attack involved a compromised laptop belonging to a DevOps engineer. The breach allegedly allowed an unauthorised party to gain access to a service container and execute unauthorised withdrawal transactions.

“We have found no evidence of any private key leaks from wallets,” the company said, promising to release a detailed technical analysis after investigations were completed.

However, it subsequently disclosed that “subsequent investigation has uncovered additional points of breach”.

Paolo Ardoino, chief executive of Tether, the company behind the USDT cryptocurrency, said his firm had frozen approximately $1.6bn “related to a potential Binance exchange hack”.

Jeremy Allaire, chief executive of cryptocurrency platform Circle, said his company had frozen more than $800m in USDC.

USDT and USDC are both stablecoins, digital currencies designed to maintain a stable value by being pegged to traditional currencies, particularly the US dollar.

The United States Department of Justice and the Federal Bureau of Investigation (FBI) did not immediately respond to requests for comment.

For several hours before Binance confirmed the attack, industry observers had reported that hackers had managed to penetrate the platform.

The prices of most major cryptocurrencies fell following news of the cyberattack, while stablecoins were largely unaffected because their values are designed to fluctuate within narrow margins.

Bitcoin and Ethereum plunged by nearly five per cent and six per cent, respectively, while BNB, Binance’s native cryptocurrency, fell by almost 10 per cent.

The attack comes amid growing concerns among industry observers that the expanding capabilities of artificial intelligence (AI) models could undermine cryptographic systems and IT security protocols.