The world’s largest cryptocurrency exchange lost more than $6 billion in about 20 minutes. Analysts widely suspect a North Korean military hacking unit. Here is what we know — and why it matters.

Sometime after 4:05 p.m. Eastern on Thursday, someone walked into the digital vaults of Binance and walked out with roughly $6.3 billion in cryptocurrency. It took about 20 minutes for the money to leave the exchange’s wallets — a speed that has left investigators, regulators and rival trading platforms scrambling to trace funds that can now move across borders as fast as the internet carries them.

The heist is thought to be the largest cryptocurrency theft in history and the biggest single cyber robbery of any kind. It has stunned an industry that markets itself on security, revived questions about how crypto exchanges are regulated, and drawn in the FBI, the US Secret Service and Britain’s Financial Conduct Authority.

What exactly is a crypto exchange?

A crypto exchange is the industry’s answer to the New York Stock Exchange or the Nasdaq. Instead of shares, investors use platforms such as Binance to buy and sell digital assets like Bitcoin.

Also Read : Did the FBI Uncover $900 Million Linked to Hope Uzodinma in a Binance Wallet with $50 Million Sent to Simon Ekpa? Here’s the Truth

The investor base is broad — financial institutions, professional traders and ordinary savers hoping for a return.
Binance, founded in China in 2017, is the biggest of them all, with an estimated 300 million-plus registered users worldwide and more than $160 billion in assets under management as of 2024. It processes roughly $200 billion in crypto, with thousands of transactions every minute, handled by automated security systems.

That combination of scale and automation is precisely what makes the platform attractive to attackers — and what made Thursday’s losses so large so quickly.

What happened on Thursday?

Binance has confirmed that an estimated $6.3 billion in digital assets was taken in a “large scale” breach of its systems, and that deposits and withdrawals were suspended while it investigated.

The company’s co-chief executive, Richard Teng, said in a video statement posted on X that the affected funds came from Binance’s own hot wallet — a connected wallet the exchange uses to process customer withdrawals — rather than from customer balances.
“We never use any customer funds, so they are not impacted,” Teng said, explaining that the vast majority of user assets are held in cold storage and only moved into a hot wallet when a withdrawal is made.

Others are less measured in their language. Ari Redbord, global head of policy at crypto research firm TRM Labs, which has helped Binance trace and recover some of the stolen funds, called it “the largest bank robbery in human history.”

“Imagine a world where someone could walk into a bank and walk out with $6.36 billion in stolen funds and then move those funds at the speed of the internet,” he said. “This is bank robbery in the age of technology.”

How did the hackers get in?

That is the question Binance is still answering, and several key details remain unconfirmed.
According to the company, initial investigations point to a compromised DevOps engineer’s laptop as the likely entry point, which would have allowed an attacker to reach a service container and execute unauthorised withdrawal transactions.

Teng said the attackers abused a known multi-signature protocol, EIP-7702, to obtain on-chain execution approval over the hot wallet — a delegation that did not pass through Binance’s normal approval controls. That, he said, is why withdrawals had to be stopped.

Binance says it has found no evidence that wallet private keys were leaked, and that it has since uncovered “additional points of breach.” Teng described the incident as “complex” and said investigators believe more than one person was involved, adding that the hackers appear to have used a “self-destruct mechanism” that destroyed their tooling and traces as they went, making tracing harder.

The BBC reported that one expert estimated most of the money left Binance’s wallets in about 20 minutes.
It is worth being precise about what was and was not hacked.

The blockchain itself — the public ledger recording every transaction — was not broken. The exchange holding customers’ digital keys on their behalf was.

How much has been recovered, and who pays?

Binance says about $3 billion of the stolen assets has been frozen or protected on-chain, in cooperation with other exchanges, blockchain analytics firms and law enforcement.

Those frozen assets remain subject to ongoing recovery and verification.
The company has committed to covering the full amount of the losses from its own funds.

Teng said Binance had set aside more than $6.34 billion in company capital to do so — including $5 billion already held in the affected cryptocurrencies, with the rest purchased on the market. A full proof-of-reserves report was promised by Monday, with an initial view before that.

Teng said the withdrawal service is being rebuilt and will not be switched back on until it “passes rigorous testing,” with the company aiming to restore services within 40 hours. A full security review across the business is also under way.

Related Stories

TRM Labs’ Redbord warned that the hackers still hold a substantial share of the proceeds, meaning tracing and recovery efforts are far from finished. Investigators chasing the money have said the work could take months.

Why do analysts point to North Korea?

Two blockchain intelligence firms — TRM Labs and Chainalysis — have linked the attack to TraderTraitor, a North Korean military hacking unit with a long record of crypto theft.

Chainalysis said it has a “high degree of confidence” in the attribution.
TRM Labs said several elements of the Binance attack resemble earlier North Korea-linked incidents, including the hack of the Bybit exchange in 2025, in which $1.5 billion was stolen — previously the largest crypto heist on record.

Analysts have also observed funds from this hack “commingling” with funds from an earlier theft widely attributed to North Korean actors.
“North Korea has built the most sophisticated cyber capabilities in the world.

They have a cadre of teams of professional hackers who are part of their military,” Redbord said. “This isn’t just a commercial hacker who’s looking to make some money. This is going to be used for weapons proliferation and other destabilizing activity.”

Western security services have repeatedly accused Pyongyang of stealing cryptocurrency to fund its nuclear and missile programmes.

North Korean hackers are believed to have stolen at least $2.02 billion in crypto in 2025 alone, according to experts, and roughly $10 billion has been taken from crypto platforms in recent years. North Korea has denied involvement in past hacking campaigns.

Binance has not directly answered questions about a possible North Korean link, saying only that it is working closely with law enforcement “to identify the perpetrators and hold them accountable.”

Cross-border attribution carries limited practical consequence. As crypto specialist Grégory Raymond told France Inter, the suspected North Korean connection means conventional justice has few options. “Only North Korea can do that,” he said, adding that any other country, company or individual attempting such a theft could eventually be tracked down.

What does this say about the safety of crypto exchanges?

Researchers say it is too early to say whether Binance’s security systems had major flaws. What the heist does demonstrate, they argue, is the sophistication and speed of the attackers.

Critics of the sector say it also exposes a structural problem.
Crypto exchanges occupy a dual role that traditional markets deliberately separate: they are both the trading venue and the custodian. Customers buy and sell on the platform and leave their holdings there for safekeeping, which makes exchanges unusually tempting targets.

“You may trade on the New York Stock Exchange, but you don’t keep your funds with the New York Stock Exchange. You keep it with your broker — and your broker is audited and regulated by the SEC,” said Amanda Fischer, policy director and chief operating officer at financial consumer advocacy group Better Markets. “And your broker has to pay for insurance that will make customers whole in the event that there’s a cyber attack.”

“So the regulatory framework for crypto is much weaker than what investors in the US enjoy in other markets.”
Binance has promised to repay customers caught up in the heist, though it is not necessarily legally bound to do so under current rules. Critics worry that smaller exchanges would struggle to make investors whole after a loss of this scale, leaving traders to absorb the damage.

The US Secret Service said it is working “around the clock” with partners to identify, freeze, trace and recover the stolen funds. The FBI said it is “aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity.” Britain’s FCA said that while Binance is not registered with it to provide crypto services in the UK, it is “aware of the reported incident and engaging with them to understand the impact.”

Does this reinforce the “Wild West” reputation?

For many critics, yes.
They warn that weak or unclear rules for crypto executives can create perverse incentives. In 2022, FTX — then the largest crypto exchange — ran into trouble during a period of intense market volatility and dipped into customer funds in an attempt to rescue itself. The company collapsed, and its founder and chief executive, Sam Bankman-Fried, was sentenced to 25 years in prison for fraud, among other charges.

“If a trade goes bad, it can become almost irresistible to dip into those client funds. Just this one time, is what they say, to cover their losses,” Fischer said. “But we know that that can cascade into catastrophe for investors.”

This is not Binance’s first breach. In May 2019, hackers stole 7,000 bitcoins — then valued at about $41 million — in a single raid, forcing the exchange to suspend withdrawals for several days. Binance replaced the lost funds through its Secure Asset Fund for Users, an emergency insurance pot, and made similar pledges to customers this week.

Crypto Exchange Binance Hacked, What happens next

Three things to watch.
Recovery. Roughly half the stolen assets have been frozen. The rest is moving, and investigators say converting it into conventional money — a process known as off-ramping — is the moment of greatest exposure for the thieves. That is where the trace can be picked up.

Proof of reserves. Binance has promised an audited-style snapshot of its holdings. How quickly and how convincingly it delivers will shape whether users trust the platform enough to leave funds on it.

Regulation. The attack lands with unusual force because the sums involved are so large. In the US, industry figures have been calling for stricter cybersecurity standards for crypto platforms. Whether this heist produces rules or just rhetoric is the open question.

For now the ledger is public, the money is moving, and the men in Pyongyang — if analysts are right — are already laundering the largest bank robbery in history.