A cyberattack lasting just 20 minutes has resulted in an estimated $6.3 billion cryptocurrency theft from Binance, the world’s largest cryptocurrency exchange. The breach has triggered a sell-off across crypto markets, temporarily disrupted withdrawals, and sparked an international effort to trace and recover the stolen digital assets.
The attackers are suspected of having links to North Korea, whose state-backed hacking groups have repeatedly been accused of targeting cryptocurrency platforms to generate funds. US blockchain analytics firm TRM Labs attributed the attack to TraderTraitor, a North Korean-linked hacking group.
Binance has maintained that customer funds remain safe and pledged to cover the losses using its own reserves. Meanwhile, blockchain investigators, cryptocurrency companies, and US law enforcement agencies are working to identify the stolen assets and prevent their conversion into usable funds.
The exchange said it had located approximately $3 billion of the stolen cryptocurrency, while stablecoin issuers have frozen another significant portion. However, the whereabouts of the remaining assets remain uncertain.
How did hackers pull off the $6.3 billion Binance heist?
The attack targeted Binance’s digital infrastructure responsible for authorising and processing cryptocurrency transactions.
Unlike traditional banks, cryptocurrency exchanges rely on digital wallets to store and transfer assets. These wallets are generally divided into two categories: hot wallets, which remain connected to the internet for faster transactions, and cold wallets, which are kept offline to provide greater security.
The hackers reportedly targeted a Binance-controlled hot wallet by exploiting vulnerabilities in the system responsible for approving transactions.
According to blockchain analytics firm TRM Labs, the attackers compromised Binance’s signing infrastructure, which authorises the movement of cryptocurrency. This allowed them to issue transaction instructions that emptied the affected wallets without triggering the exchange’s usual approval safeguards.
“In layman’s terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money,” Joshua Chu, a Hong Kong lawyer specialising in cryptocurrency cases, told Reuters.
Binance co-CEO Richard Teng described the incident as a “complex attack” involving a compromised laptop and malicious software designed to erase evidence of its activity.
The incident highlights how vulnerabilities in transaction approval systems can expose even major cryptocurrency exchanges to substantial financial losses.
North Korean hackers suspected of carrying out the attack
Investigators suspect that the cyberattack was carried out by TraderTraitor, a hacking group associated with North Korea.
According to TRM Labs, the group has been linked to several cryptocurrency theft operations and is believed to operate as part of North Korea’s broader cybercrime network.
Cryptocurrency thefts have become an important source of revenue for North Korean hacking operations, with stolen digital assets potentially helping the country bypass international financial restrictions.
The attribution also raises concerns about the growing sophistication of state-backed cyberattacks targeting cryptocurrency exchanges and other financial infrastructure.
Where has the stolen cryptocurrency gone?
Recovering the stolen funds has become a major priority for Binance and international investigators.
Unlike conventional cash theft, cryptocurrency transactions are recorded on public blockchains, allowing investigators to follow the movement of assets between digital wallets. However, tracing a transaction does not automatically mean authorities can recover the funds.
Hackers can move stolen cryptocurrency across multiple wallets, convert it into different digital assets, and use intermediary services to make recovery more difficult.
Binance has reportedly identified approximately $3 billion of the stolen assets, while stablecoin issuers have frozen additional funds associated with the attack.
The remaining cryptocurrency is still being traced, with investigators attempting to identify wallets, exchanges, and other services that could help establish where the money has gone.
Credits: PBS
Binance promises to protect customer funds
The breach triggered market uncertainty and forced Binance to temporarily suspend withdrawals as it investigated the incident and strengthened its security measures.
The exchange has insisted that customer assets remain safe and that it will absorb the financial losses rather than pass them on to users.
Nevertheless, the scale of the incident has renewed questions about cryptocurrency exchange security, particularly the risks associated with internet-connected wallets and transaction authorisation systems.
As investigators continue tracking the stolen assets, the Binance breach could become a landmark case in the ongoing battle against organised cryptocurrency cybercrime.
