Attackers moved roughly $6.3 billion out of Binance hot wallets across ten blockchains in about 20 minutes, in what analysts are calling the largest theft of any kind on record. Multiple blockchain intelligence firms attribute the attack to North Korea’s TraderTraitor unit.
Summary
- Binance, the world’s largest cryptocurrency exchange, confirmed a breach affecting an estimated $6.3 billion in digital assets; TRM Labs puts the figure at approximately $6.36 billion and Chainalysis at around $6.4 billion.
- More than $2.5 billion left in a single transaction, and most of the funds were moved within roughly 20 minutes across ten blockchains.
- Binance says the intrusion began with a compromised engineer’s laptop, with its investigation since uncovering additional “points of breach”. It reports no evidence that wallet private keys were leaked.
- TRM Labs (with high confidence), Chainalysis and Elliptic attribute the attack to TraderTraitor, the DPRK unit the FBI blamed for the $1.5 billion Bybit heist in February 2025.
- Around $3 billion has been frozen with the help of partners and token issuers. Binance has pledged to cover all user losses from its own funds; withdrawals are suspended and expected to resume within a day or two, while deposits are unaffected.
What happened
The attackers did not break any cryptography. According to Binance and analysts at Elliptic, they compromised a laptop belonging to a Binance engineer and used that foothold to reach the exchange’s internal systems. From there, they caused Binance’s own infrastructure to sign transactions that sent funds from internet-connected “hot” wallets to attacker-controlled addresses. Cold storage, which holds the bulk of customer assets offline, does not appear to have been the target.
TRM Labs reports that preparation began at least 36 hours before the theft, with attacker wallets pre-funded through the Tornado Cash mixer and transaction signatures obtained in advance. Once execution started, the drain was close to instantaneous: the majority of the $6.36 billion moved in about 20 minutes, leaving very little window for human intervention.
Who is behind it
TraderTraitor is a North Korean state-sponsored group that emerged from the wider Lazarus cluster operating under the Reconnaissance General Bureau, Pyongyang’s military intelligence agency. The US government named the unit and the FBI previously attributed the Bybit theft to it. TRM Labs says several features of the Binance attack mirror earlier DPRK operations, and Elliptic reports that some stolen funds have already been traced to wallet addresses used in another exchange hack last month that is also linked to North Korea.
Binance has not confirmed attribution, saying only that it is working with law enforcement partners to identify those responsible. North Korea has long relied on cryptocurrency theft as a sanctions-evasion revenue stream to support its economy and weapons programmes, and crypto platforms remain attractive because assets are easier to move and launder than funds in the traditional banking system.
The scale in context
At more than four times the size of the Bybit theft, the Binance incident resets the benchmark for crypto losses. Elliptic notes that before Bybit, the largest known theft was the roughly $1 billion taken from Iraq’s central bank on the eve of the 2003 war; Binance is more than six times larger. The market impact was visible on Friday, with bitcoin trading below $78,000.
Recovery and customer exposure
Freezing is not the same as recovery. TRM Labs notes that stablecoins such as USDT and USDC are the most recoverable assets because their issuers can freeze, burn and reissue tokens once a court order or seizure warrant is in place. Bitcoin and ether have no issuer, so recovery depends on tracing funds until they hit a cooperating exchange or other centralised service. Chainalysis cautions that while a technical freeze can happen quickly, returning funds can take months or years.
Fundstrat estimates around $3.3 billion remains unfrozen. Binance’s SAFU emergency fund, valued at roughly $1.2 billion, could cover about a third of that, with the rest coming from the exchange’s own reserves. Analysts currently see no meaningful solvency risk, but the signals to watch are how quickly withdrawals resume and whether outflows stay orderly. Customers should note that any make-good comes from Binance alone: crypto holdings carry no deposit-insurance protection in the US, UK or Australia.
Why it matters
This is an identity and endpoint compromise that became a financial catastrophe because signing authority was reachable from a single engineer’s workstation. Commentators have already questioned why stronger approval controls were not in place, with one security CEO suggesting a single signature effectively handed the attacker long-lived, full-access authority over a hot wallet. Binance has said it found no key leakage, but the outcome is the same: the system trusted itself, and the attacker became the system.
The lesson extends well beyond crypto. Any organisation where privileged engineers can trigger high-value, irreversible actions, whether payment releases, code signing, production deployments or cloud key operations, faces the same pattern. TraderTraitor’s playbook is consistent: patient targeting of developers and engineers through social engineering and malicious tooling, pre-staged infrastructure, and execution faster than any manual control can respond. When attacks complete in 20 minutes, detection that relies on a human reviewing an alert is already too late.
What to do now
- Treat engineer, developer and DevOps endpoints as tier-zero assets. Enforce hardened builds, EDR with tamper protection, application allowlisting and strict controls on packages, browser extensions and “job interview” coding tests, a known DPRK lure.
- Separate signing authority from day-to-day workstations. High-value transactions and key operations should require hardware-backed, multi-party approval from independent devices, with no standing or long-lived tokens.
- Apply velocity and value limits to automated outflows, payments and hot wallets, with circuit breakers that halt transfers automatically when thresholds or unusual destinations are hit.
- Hunt for pre-staging indicators such as new or recently funded destination addresses, mixer-linked funding, unusual pre-signed transactions and anomalous access to signing services in the days before execution.
- Review third-party and custodial exposure. If your organisation holds digital assets or relies on exchanges, confirm insurance coverage, recovery commitments and contractual notification terms, and do not assume regulatory safety nets exist.
- Rehearse a high-speed financial-loss scenario in tabletop exercises, including pre-established contacts with law enforcement, blockchain analytics firms and stablecoin issuers for rapid freezing.
Sources
- The Guardian: How big a deal is the $6.3bn crypto heist, who did it, and are investments safe?
- CNBC: Binance’s $6.3 billion hack: What we know and what comes next
- NPR / AP: Blockchain intelligence firms link North Korea to $6.3B hack on Binance
- CBS News: $6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
