defi · · 2 outlets
$6.4 billion stolen from Binance, North Korea linked to crypto hack
Investigations have linked the $6 billion theft from Binance to actors from North Korea, detailing how the hot-wallet signing infrastructure was compromised and tracking the flow of the stolen funds.
Attackers connected to North Korea successfully siphoned off approximately $6.4 billion from Binance, the world's foremost cryptocurrency exchange, in what constitutes the largest crypto heist ever recorded, exceeding the previous record by more than fourfold.
The theft commenced around 4:05 p.m. ET on Thursday, subsequent to the closing of U.S. markets, when the perpetrators moved assets out of Binance's hot wallets across approximately 10 different blockchains, with the majority of the movement occurring within about 20 minutes. Blockchain analytics firms Chainalysis and TRM Labs calculated the total amount to be near $6.4 billion, which is more than four times the $1.5 billion taken in the Bybit heist in February 2025. It is important to note that the attack specifically targeted Binance's internal systems, rather than the blockchains themselves.
Initially, Binance attributed the intrusion to a compromised laptop belonging to a DevOps engineer, suggesting this may have allowed the attacker to access a service container and submit unauthorized withdrawals. However, the exchange later stated that its review uncovered "additional points of breach," and CEO Richard Teng characterized the event as involving "a more complex attack process" that "did not simply use one engineer’s permissions." Binance reported finding no indication that wallet private keys had been exposed, and the attacker utilized a self-destruct mechanism to erase tooling and any traces of their activity.
According to TRM Labs, on the Ethereum network, the attacker exploited EIP-7702, a feature implemented in 2025 that permits standard wallets to temporarily execute smart-contract code. By leveraging 50 pre-signed authorizations, the attacker transformed a Binance hot wallet into a "sweeper" contract and drained its holdings. Teng commented that this delegation "did not pass through our normal approval controls." TRM noted that this incident did not reveal a vulnerability within Ethereum itself, but rather indicated a compromise of Binance's signing infrastructure.
Both TRM Labs and Chainalysis assigned responsibility for the hack to TraderTraitor, a group associated with the North Korean state and also implicated in the Bybit incident. Following this raid, the group converted about 84% of the Ethereum that was stolen into Bitcoin using the cross-chain network Thorchain. This attribution elevates North Korea’s total crypto acquisition for 2026 well beyond $1 billion, with the Binance loss alone dwarfing all other figures. Teng affirmed that Binance will cover every single dollar of the losses using the company's own capital and its Secure Asset Fund for Users, an emergency reserve, emphasizing that customer assets remained untouched. The exchange has allocated over $6.34 billion, with approximately $5 billion of that already held in the precise tokens that were stolen, including BTC, ETH, BNB, USDC, and USDT; the remainder is being acquired through the open market and over-the-counter. Binance has suspended withdrawals while it undertakes a full security review and rebuilds its systems, intending to resume withdrawals by Sunday and release a complete proof of reserves by Monday, while deposits continue to function normally.
Unlike previous security events, stablecoin issuers reacted swiftly after initial reports of a potential attack. These dollar-pegged tokens, which form the foundation of the crypto economy and facilitate quick, easy transactions across both centralized and decentralized exchanges, are centralized entities managed by private corporations, unlike digital currencies such as Bitcoin or Ethereum. This centralization allows these funds to be frozen at any time, for any reason. Tether, the issuer of the most prominent stablecoin, USDT, froze assets exceeding $1.5 billion. Circle, which manages the second largest stablecoin, USDC, froze approximately $823 million linked to the attack, both utilizing their capacity to blacklist specific addresses. In total, around $3 billion has been either located or frozen. Nevertheless, a substantial amount remains inaccessible; the attacker still maintains control over over 420,000 ETH and 18,270 BTC, alongside other tokens valued at more than $3 billion, which no issuer can freeze, as the attacker continues to move funds via Tron and other networks. Elliptic, a security firm, estimated that the hacker still controls roughly $3.3 billion.
Binance is collaborating with global law enforcement agencies, including the FBI and the U.S. Secret Service. The FBI confirmed its awareness of the event and its coordination with partners, while the Secret Service, which investigates digital-currency and financial crimes, declined to offer a statement. This echoes prior joint operations, such as Operation Atlantic in April, which successfully tracked tens of millions in stolen cryptocurrency.
Despite the magnitude of this theft, market reactions remained surprisingly calm. Bitcoin declined to about $76,400 on Friday, representing a drop of roughly 4%, and over $1.3 billion in leveraged positions were liquidated. This contrasts sharply with March 2018, when a failed attempt to attack Binance caused Bitcoin to fall nearly 11% in minutes. Analysts attribute this steadiness to a larger, more developed market, which is currently valued at approximately $2.6 trillion, partly due to spot Bitcoin ETFs holding about 1.3 million BTC in hands that are not prone to panic selling. Wall Street institutions, including Compass Point, TD Cowen, and Cantor Fitzgerald, even encouraged their clients to purchase crypto-linked stocks during the downturn, framing the hack as a failure of Binance's security rather than a threat to the underlying technology.
CFTC Chairman Michael Selig used the breach as grounds to advocate for increased U.S. regulatory oversight on offshore exchanges. In an interview with CNBC, Selig stated that the breach "proves our exact point" regarding the crypto-market regulations the agency proposed earlier this month. Furthermore, the incident instigated a public disagreement between Binance founder Changpeng Zhao, known as CZ, and Elon Musk. The founder of SpaceX and Tesla appeared to mock Binance regarding the hack on X, to which CZ responded by referencing Musk's own stake in SpaceX. CZ posted, "Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support,". Overall, CZ maintained a defiant stance, noting that while the theft is the largest in terms of dollar value, it is not the largest in Bitcoin terms, and unlike FTX or Mt. Gox, Binance is absorbing the financial damage itself. He wrote, “It hurts, but we survive.”
Earlier coverage
Reported by theblock.co and Decrypt.
