Tech • AI • Robotics • Game
6.3 billion stolen in 20 minutes: how Binance got hacked!
7/10TL;DR
A $6.3 billion theft from Binance has intensified fears over crypto security, with evidence pointing to a North Korean operation that relied on human compromise rather than any failure of blockchain technology.
KEY POINTS
A record-scale theft in 20 minutes
Around 21:00 in Paris on Thursday, funds began leaving Binance wallets across 10 blockchains, including XRP, Solana, Bitcoin, Tron and Ethereum. The exchange said about $6.3 billion was drained in roughly 20 minutes, a sum described by blockchain analysts as likely the largest theft in history, not just in crypto. The haul was far larger than the Bybit hack in February 2025, previously considered the benchmark case.
The attack appears to have started with a compromised laptop
Early indications suggest the intrusion began with the laptop of a Binance DevOps engineer, giving attackers access to an internal service used to process withdrawals. The incident does not appear to involve a stolen private key or a flaw in any blockchain. Security specialists say such a theft could not plausibly have depended on one employee alone, implying additional layers of compromise deeper in internal systems and approval chains.
Stablecoin issuers helped freeze part of the loot
Within about an hour, Tether and Circle froze close to $1.8 billion in stablecoins connected to the theft. That rapid intervention limited the attackers’ ability to move part of the proceeds. Binance has said it will cover user losses with its own funds, and some withdrawals had already resumed by the weekend.
Suspicion centers on North Korea’s Lazarus ecosystem
Investigators and blockchain-tracing firms have linked the operation to TraderTraitor, a unit associated with Lazarus, the umbrella name commonly used for North Korean cyber groups. These teams are known for mixing patient social engineering with advanced technical methods. Their recent focus has been crypto platforms, while other affiliated units are tied to banks, malware campaigns and infiltration of foreign companies.
A state-run hacking industry
The groups attributed to Pyongyang operate less like isolated criminals than like a structured arm of the state. Specialists describe divisions dedicated to recruitment scams, fake venture-capital outreach, employee infiltration and exchange theft. Some operatives reportedly work from North Korea, while more trusted or capable members are deployed to neighboring countries such as China.
Crypto theft has become a major revenue source for Pyongyang
Since 2017, North Korea has been linked to about $13 billion in digital theft, including roughly $7.4 billion in 2026 alone. With the country’s estimated GDP near $34 billion, that would amount to roughly 22% of annual economic output. UN estimates have indicated such cyber theft helps finance up to 40% of the regime’s weapons programs, turning digital crime into a strategic funding tool.
The laundering methods are becoming more sophisticated
The objective is not only to steal crypto but to convert or reposition it into assets that cannot be easily frozen. Attackers increasingly prefer tokens such as Bitcoin or Ether over centrally issued stablecoins. In one observed tactic, stolen stablecoins were deposited into a lending protocol and used as collateral to borrow Ether, reducing exposure to freezes by centralized issuers.
The weak point remains people and supply chains
Recent incidents show that the biggest risks often come from human compromise and third-party dependencies rather than the underlying code. A separate case involving Ledger devices sold by resellers in Thailand and Germany exposed tampered hardware with spy chips inserted after distribution. Polymarket also suffered another breach tied to a service provider, reinforcing the pattern that attackers increasingly target trust relationships around crypto systems.
Security trade-offs are shifting
The incident has renewed debate over whether assets are safer in personal custody or on large centralized exchanges. Self-custody avoids institutional control, but a single mistake or robbery can mean permanent loss. Large exchanges carry concentration risk, yet the biggest players can freeze funds, absorb losses and reimburse customers, making them look, in some cases, more like heavily capitalized banks than purely decentralized infrastructure.
CONCLUSION
The Binance theft underscores that crypto’s biggest vulnerabilities now lie less in blockchains themselves than in people, vendors and operational security. As North Korea industrializes cyber theft, the central question is no longer whether digital assets can be stolen, but which institutions are still strong enough to contain the damage.
Ask a question