Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor.
Cryptocurrency giant Binance said on Thursday that $6.3bn (£4.7bn) of digital assets have been impacted by what could be the largest hack in history.
The world's biggest crypto exchange said about half of those assets had been frozen but that many remained in the hands of the hackers, adding that it will "cover all losses".
Early checks show the incident may have involved an engineer's laptop that had been compromised, which allowed an attacker to make unauthorised withdrawals, Binance said.
Two analytics firms have attributed the incident, which eclipses a record-setting $1.5bn hack on the Bybit exchange in 2025, to a North Korean hacking unit called TraderTraitor.
AI-powered investigations company TRM Labs said in a report that several elements of the Binance attack resemble earlier North Korean-linked incidents, including the Bybit hack.
The lab's global head of policy Ari Redbord told the BBC the Binance hack is a "watershed moment" that is unlike anything the industry has seen.
The attacker still holds an enormous sum of stolen assets, meaning efforts to trace and recover the funds are far from over, Redbord added.
Chainalysis, another crypto analytics firm, also said it has "high confidence" that the North Korean group are linked to the hack.
Eric Jardine, Chainalysis' Head of Research, urged every exchange to remain vigilant as the platforms are attractive targets for hackers due to the sheer value of assets.
Binance did not directly respond to BBC queries about the incident's potential links to North Korea but said: "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."
The incident concerns Binance.com - while much smaller crypto platform Binance.US, which provides trading services specifically for American residents - said its platform is not affected by the issue.
In a series of posts, Yi He, Binance's co-chief executive, thanked various cryptocurrency issuers for freezing the assets.
"Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said.
Two other major crypto platforms, Tether and Circle, said they have frozen a total of about $2.4bn of assets in response to the potential Binance hack.