Binance Loses $6.36 Billion in Largest Crypto Heist on Record

Approximately $6.36 billion in digital assets moved out of Binance wallets across ten different blockchains in a span of roughly 20 minutes. This single event stands as the largest cryptocurrency theft in history, according to data released by blockchain intelligence firm TRM on Thursday. The exchange, which operates as the world’s largest platform for buying and selling crypto, confirmed the scale of the impact on its users.

The timeline of the breach began with what Binance initially described as a compromised laptop. Subsequent internal investigations revealed additional points of breach that extended the attack beyond a single device. On Friday, the company announced it had frozen roughly $3 billion in affected assets through cooperation with blockchain partners. It also stated that it would begin the process of recovering assets for impacted users immediately.

Two major intelligence firms have linked the operation to North Korea. TRM attributed the attack to TraderTraitor, a unit it identifies as the DPRK’s elite hacking team. The firm stated it makes this judgment with high confidence. Chainalysis, a separate blockchain analysis company, reached a similar conclusion. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely executed by the North Korean group.

The attack mirrors the methods used in a $1.5 billion heist on the Bybit exchange in February of last year. TRM noted that several technical features of the Binance incident match those earlier North Korea-linked thefts. The FBI had previously confirmed that North Korea and TraderTraitor were responsible for the Bybit hack. This pattern suggests a sustained strategy by the North Korean government to target global crypto infrastructure.

North Korea has increasingly relied on illicit cyber activities to generate foreign currency. These funds support the country’s struggling economy and finance its nuclear program, especially following stringent United Nations sanctions. In December 2022, South Korea’s spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in virtual assets over five years. The agency described North Korea’s capability in this area as among the best in the world.

Changpeng Zhao, the founder of Binance, addressed the incident on social media on Thursday. He confirmed that user funds are safe and acknowledged that the event appears to be a hack on the platform. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering, he remains a shareholder. Zhao added that he expects all user funds to be fully covered by the company.

Binance has suspended withdrawals while it completes its investigation. The company expects these services to resume within the next one or two days. Deposits, however, were not affected by the breach. A spokesperson for Binance said the company is working closely with law enforcement partners to confirm the identity of the criminals. The firm stated it has found no evidence of a wallet private key leak.

Cybersecurity experts are questioning the internal controls that allowed the theft to proceed. Kok Tin Gan, co-founder and CEO of NyxLab, suggested the attacker obtained a signature that granted a never-expiring, full-access token to a Binance hot wallet. Hot wallets hold private keys and are connected to the internet. Binance plans to release further technical details once its probe is complete.