Binance Loses $6.3 Billion as Analysts Trace Record Heist to North Korea
SINGAPORE — Attackers drained roughly $6.3 billion from Binance in about 20 minutes, turning a compromised exchange into the site of what analysts called the largest known financial theft in history. The world’s biggest cryptocurrency platform halted withdrawals, promised to cover every loss and began trying to freeze the stolen assets. Blockchain investigators, meanwhile, traced the operation to North Korea with high confidence.
The theft unfolded late Thursday, October 29, and forced Binance into public crisis mode on Friday. Reuters reported that the attackers ordered Binance-controlled wallets to empty into wallets under their control. TRM Labs calculated that approximately $6.36 billion moved across ten blockchains, most of it during a single 20-minute burst. The Associated Press independently reported the same figure and attack window.
Binance said its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer. That access may have allowed the attackers to reach service containers and submit unauthorized withdrawal orders. The exchange said it found no evidence that private wallet keys had leaked, but it later acknowledged additional points of breach and promised a full technical account after investigators finish tracing the attack.
The company’s first line of defense came after the money had moved. Tether froze nearly $1.57 billion, Circle blocked more than $800 million, and other issuers and custodians helped immobilize additional tokens. Binance said about $3 billion had been frozen on-chain. The remaining $3.3 billion was still unaccounted for in its latest public update.
That distinction matters. Freezing a token can stop an attacker from spending it, but it does not automatically restore the money to customers. Recovery depends on the cooperation of issuers, exchanges, custodians and law-enforcement agencies across jurisdictions. Binance said it was working with police and blockchain firms, while Reuters reported that the FBI and U.S. Secret Service were involved.
The exchange has set aside about $6.34 billion of company funds to absorb the loss. “Your money is safe and we’re covering every loss,” co-CEO Richard Teng said. Binance also suspended withdrawals and said it expected to restore them within 48 hours. Those commitments may prevent an immediate customer run, but they do not answer how one compromised machine — or a chain of related access failures — defeated controls around wallets holding billions of dollars.
Three blockchain intelligence firms — TRM Labs, Chainalysis and Elliptic — attributed the theft to North Korea. TRM and Chainalysis said they were highly confident that the operation came from TraderTraitor, a state-linked hacking unit previously blamed for the $1.5 billion theft from Bybit in 2025. Binance has not named a culprit and said it was working with law enforcement to confirm the attackers’ identities. Pyongyang routinely denies responsibility for state-backed cryptocurrency theft.
The attribution carries geopolitical weight. U.S. and South Korean authorities have long accused North Korean cyber units of stealing digital assets to obtain hard currency under sanctions and help fund the state’s weapons programs. Crypto networks give those units a target-rich environment: vast pools of transferable value, uneven security and transactions that can cross borders before regulators or police coordinate a response.
The heist also punctures the industry’s claim that scale produces safety. Binance reported 335 million registered users and $162.8 billion in assets under custody at the end of 2025. Yet the exchange’s own account suggests that attackers may have turned access to an employee device into authority over wallets worth more than the annual budgets of some states.
Markets registered the shock. Bitcoin touched a six-week low, ether fell to a two-month low and Binance-linked BNB dropped sharply before prices stabilized. The immediate losses belong to Binance. The credibility loss belongs to the centralized crypto model, which asks users to trust private companies with systems that operate like banks while resisting bank-like transparency and supervision.
Binance can replace the stolen tokens. It cannot replace the unanswered controls with promises. Until the company publishes a verifiable post-mortem, the central fact remains brutal: a platform built to move money without borders also allowed a suspected state hacking unit to move $6.3 billion before anyone could stop it.
Sources: Reuters; Associated Press; Binance security update.
Comments