Binance, the world's biggest cryptocurrency exchange, said $6.3 billion of digital assets were affected by what could be the largest hack ever.
The company said about half the assets had been frozen, but many remained in the hands of the attackers.
Binance said it would "cover all losses".
Early checks suggest a compromised engineer's laptop allowed an attacker to make unauthorised withdrawals.
The theft dwarfs the previous record, a $1.5 billion hack of the Bybit exchange in 2025.
Two blockchain analytics firms, TRM Labs and Chainalysis, have linked the attack to TraderTraitor, a North Korean hacking unit.
Western security agencies have previously said stolen crypto funds helped finance North Korea's nuclear and missile programmes, an accusation Pyongyang denies.
Binance did not directly address the North Korea claims, but said it was working with law enforcement to identify those responsible.
Freezes and fallout
Tether, which issues the USDT stablecoin, said it had frozen about $1.6 billion linked to the incident.
Circle, issuer of the USDC stablecoin, said it had frozen more than $800 million.
Stablecoins are tokens pegged to the US dollar, and their issuers can block specific wallets.
Yi He, Binance's co-chief executive, said withdrawals were disabled until the environment was confirmed to be secure.
The hack affects Binance.com only; Binance.US and rival Coinbase said they were unaffected.
Bitcoin fell more than 4% on the news, and Ethereum and Solana also dropped sharply.
Binance, founded in 2017, is estimated to have more than 300 million registered users.
