The Biggest Crypto Theft in History: 6.3 Billion Dollars From Binance, and the Trail Leads to Pyongyang

Thursday night, twenty minutes. That's how long it took the attackers to pull out most of the 6.3 billion dollars from Binance, the world's largest cryptocurrency exchange. It's four times the previous record: 1.5 billion dollars from the Bybit exchange in February 2025.

The American firm TRM Labs estimates that approximately 6.36 billion dollars was moved out of Binance's digital wallets, across ten different blockchain networks. The preparations took at least 36 hours: first a few small test transactions, to see if everything worked, then the main strike. The attackers took control of the infrastructure that approves transfers and issued orders to themselves. Picture a robbery where the thief doesn't crack the safe, but orders the bank to carry the money out for him.

Binance first said the breach probably began with one engineer's compromised laptop. A later investigation found additional points of entry. The company claims there is so far no evidence that private keys were stolen and promises to cover all losses from its reserve fund and its own money. "User funds are safe," the statement read. It also read that deposits and withdrawals were temporarily halted. Your money is safe, you just can't take it out for now.

Why everyone is looking at Pyongyang

TRM Labs attributes the attack "with high confidence" to the hacker group TraderTraitor, linked to the North Korean regime. TraderTraitor is also linked to the Bybit theft, which the FBI at the time officially attributed to North Korea. Chainalysis found that some of the money began mixing with funds from an earlier attack on the Bitget exchange, also attributed to North Korean hackers, and Elliptic confirmed that part of the stolen money ended up at an address already linked to that attack.

Officially, nobody has said that name yet. Neither the American authorities nor Binance have confirmed the attackers' identity. The company says only that it is cooperating with investigators, including the FBI and the US Secret Service.

Why does it matter? According to American and international investigators, thefts like this are one of the sources of money for Kim Jong Un's regime, including its military and nuclear programmes. A state under sweeping international sanctions, cut off from the normal banking system, has found itself a counter where nobody asks for ID. Tom Robinson, co-founder of Elliptic, said that if North Korea's responsibility is confirmed, this theft alone would nearly double the total value of the crypto the regime has stolen so far.

What got saved is what has a boss

Binance and its partners quickly froze around three billion dollars, mainly in stablecoins whose issuers can block transactions. Tether said it blocked around 1.6 billion dollars in USDT, and Circle more than 800 million in USDC. The rest is another story. Elliptic estimates that around 3.3 billion dollars remained out of reach of such measures, mainly in bitcoin, ether and other cryptocurrencies with no central body that can press stop. The attackers are using thousands of automated transactions to cover their tracks, and Chainalysis talks of never-before-seen patterns of hiding money.

Here's the irony of the whole thing. Cryptocurrencies were sold for years as money without a boss. When the biggest theft in their history came, what got saved was exactly what has a boss with a block button. What had no boss is gone.

The bitcoin price fell by more than 4 percent, and Ethereum and Solana took a hit too. Binance has more than 300 million registered users worldwide and in 2024 reported more than 160 billion dollars in customer assets in custody. Independent analysts were warning of suspicious transactions for hours before the company publicly admitted it had a problem.

Investigators are now chasing money through thousands of transactions, and nobody dares say how much will come back. Anyone keeping savings on an app like this has one simpler question: when the next Thursday night comes, who's going to pick up the phone?