- The Binance hack moved about US$6.36bn across ten blockchains, mostly within 20 minutes
- The FBI blames North Korea’s TraderTraitor, the group behind last year’s US$1.5bn Bybit theft
The largest crypto theft on record appears to have started with a single compromised laptop. Binance said in a post on Xthat its initial investigation suggests the incident may involve a laptop belonging to one of its DevOps engineers. Co-chief executive Richard Teng described a “complex attack” involving malicious software designed to delete evidence of its activity, according to Al Jazeera.
From there, attackers drained about US$6.3 billion from the world’s largest cryptocurrency exchange in what AP described as the biggest crypto heist in history. On Saturday, the FBI attributed the theft, which occurred on or about October 29, to a North Korean state-sponsored hacking group it calls TraderTraitor. The attackers took roughly US$6.36 billion in cryptocurrency across ten blockchains and moved most of it within about 20 minutes, BleepingComputer reported.
The FBI said it had seen the hackers converting the stolen assets into Ethereum and expected them to launder the funds further through decentralised finance and instant swap services, and it asked virtual asset service providers to block transactions linked to wallet addresses it published.
How the Binance hack happened
The hackers reached Binance’s hot wallets, the internet-connected wallets exchanges use to process withdrawals quickly. Binance said the compromised laptop allowed the attacker to gain access to a service container and submit unauthorised withdrawal transactions, and that it has found no evidence of any wallet private key leak. The exchange has promised a detailed technical post-mortem once its investigation is complete.
The FBI also blamed TraderTraitor for the US$1.5 billion theft from the Bybit exchange in February 2025, which began with a compromised computer belonging to a developer at wallet provider Safe{Wallet}, BleepingComputer reported. In an earlier attack on Japan’s DMM Bitcoin, hackers posed as a recruiter on LinkedIn and persuaded an employee at wallet company Ginco to run malicious code disguised as a pre-employment test.
US President Donald Trump was more cautious when reporters asked him about it on Saturday, saying North Korea’sinvolvement could yet be established. “We don’t know if it’s North Korea,” he said, according to AP.
One trusted pathway
Cristiano Ventricelli, vice president for digital assets at Moody’s Ratings, said in emailed comments that the incident shows the concentration of risk inside large, centralised intermediaries.
“The incident underscores the heightened cybersecurity risks associated with hot wallets, a component already exposed by the 2025 hack on Bybit cryptocurrency exchange,” he said. Stronger controls can reduce some weaknesses, he added, but the scale of assets held can magnify the damage from a single successful breach.
Phoebe Hodgson, senior banking and payments analyst at GlobalData, argued that financial institutions need to change how they measure security. “Sophisticated attackers do not necessarily need to defeat every security control. They only need to find one trusted pathway that allows them to operate undetected,” she said in a statement. Banks should assume some defences will fail and design their operations so that a single compromise cannot become an irreversible financial loss, she said.
What Binance customers can expect
Binance, which says customers will not bear the loss, has replaced about 90% of the stolen amount by using company money to buy new tokens, with the remaining 10% in less liquid tokens that may take longer to source, and it has set aside around US$6.34 billion internally to cover the theft, according to NBC News. Withdrawals resumed in phases on Sunday. Binance said it has worked with blockchain partners to freeze about US$3 billion of the stolen assets on-chain, and that itwill publish an updated proof of reserves once remediation is complete.
Binance has said publicly that it will cover all losses from its Secure Asset Fund for Users and company funds. Alexander Shirtcliff, head of commercial disputes and class actions at UK law firm Edwin Coe, said that, taking Binance’s standard user terms at face value, the terms limit its liability to customers and contain no commitment to use that fund.
“Customers should not regard this as legally binding,” he said in emailed comments. He expects disputes over who owns the frozen assets, as there were after the collapse of FTX, and said customers who can prove ownership would, in theory, be better protected against competing claims.
His colleague Laura Clatworthy, head of digital assets at Edwin Coe, pointed to a second group of victims. Many businesses use Binance in their daily operations, she said, so the suspension of the platform will have hit them as well as the theft itself, and Binance could face legal liability for that disruption.
