Binance Loses $6.3 Billion in Largest Crypto Heist Ever, North Korea Fingerprints Everywhere

Binance has confirmed a major security breach that exposed roughly $6.3 billion in assets, making it the largest cryptocurrency theft on record. The world's biggest exchange says nearly $3 billion has been frozen so far, with stablecoin issuers Tether and Circle having locked down $1.567 billion in USDT and $800 million in USDC respectively. Arbitrum's Security Council separately froze around $30.5 million.

The attacker still controls more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, plus assorted other assets spread across roughly 43 wallet addresses. That pile includes 511,861 ETH, 233 million XRP, and 670 million TRX — none of which any issuer can unilaterally freeze.

Binance's initial explanation pointed to a compromised DevOps engineer's laptop as the entry point. An attacker apparently accessed a service container from there and submitted unauthorised withdrawal transactions. But co-CEO Richard Teng has since walked that back slightly, clarifying this wasn't a simple one-click job and that the investigation has since uncovered additional breach points beyond the laptop. No wallet private key leak has been found.

The mechanics of how the theft actually worked are, frankly, impressive in a deeply unsettling way. Blockchain analytics firm TRM Labs reconstructed the sequence: at least 36 hours before the theft, preparation was already underway. Then, at 20:20 UTC, the attacker submitted a single transaction bundling 50 pre-signed authorisations, each pointing Binance's hot wallet toward an attacker-controlled sweeper contract.

Here's the clever bit. Every wallet tracks its transaction count, a nonce, and a signed authorisation is only valid at a specific count. Binance's hot wallet processes withdrawals constantly, so its nonce keeps incrementing. By preparing signatures for 50 consecutive nonce values in advance, the attacker virtually guaranteed at least one would still be valid when executed. One matched. That was enough.

Three minutes and 24 seconds later, the hot wallet sent its entire balance — 167,464 ETH and 63 tokens, including 1.615 billion USDT — to an address the attacker controlled. Elliptic put it plainly: Binance's own systems signed the transactions. Nobody stole the private keys. The infrastructure around the keys was what got compromised.

This is almost identical to the Bybit hack from February 2025, where North Korean group TraderTraitor compromised a developer's machine at wallet provider Safe{Wallet} and manipulated a transaction before Bybit's signers approved it. Both attacks targeted people and processes rather than cryptography. Both walked away with billions.

TRM Labs, Chainalysis, and Elliptic have all attributed this attack to North Korea, with TRM specifically naming TraderTraitor. Chainalysis observed funds from last month's Bitget exploit co-mingling with stolen Binance funds at the same Ethereum address. The operational fingerprints — small Tornado Cash withdrawals funding an operator wallet, advance code testing, pre-signed transactions executed in a single burst — match the Bybit and KelpDAO playbooks closely.

That said, Elliptic's Dr Tom Robinson has urged some caution. DPRK laundering operations typically convert stolen stablecoins to native assets within minutes. Here, the attacker held stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron before moving most of it. The laundering methodology, relying on market makers and DeFi lending protocols rather than the bridge-heavy approach seen post-Bybit, is also a departure. Whether that represents operational evolution or a different actor borrowing DPRK tradecraft is still an open question.

Robinson also noted that none of the pre-attack signals would have flagged anything meaningful in real time. The attacker used Tornado Cash to fund their wallet the day before and ran small code tests a few hours prior. Suspicious in hindsight, invisible in the noise.

Binance has suspended deposits and withdrawals, revoked the compromised address authorisations, and brought in law enforcement and blockchain intelligence partners. The exchange says it will cover all losses via its Secure Asset Fund for Users and its own reserves. Withdrawals are expected to resume within 48 hours, pending a security revamp of the withdrawal infrastructure.

The broader picture is depressing but not surprising. North Korea has now pulled off what appear to be the two largest crypto thefts in history within roughly 18 months of each other. Robinson's assessment is blunt: the rewards are enormous, the risks to the attackers are negligible, North Korea is already maxed out on sanctions, and crypto theft is one of the few remaining mechanisms it has to generate hard currency at scale. Tracing and freezing capabilities have improved, which makes each individual heist slightly less profitable — but not enough to change the calculus.