How suspected North Korean hackers swiped billions in crypto in only minutes

Hackers pilfered US$6.3 billion from the world’s largest cryptocurrency exchange in a stunning attack that halted withdrawals on the platform and set off a race among digital currency companies to freeze billions in stolen funds.

The main thrust of the attack on Binance took about 20 minutes, according to third-party cyber security firms who examined public flows of cryptocurrency in and out of the exchange.

It remains unclear how the hackers managed to breach the systems of Binance to steal the US$6.3b ($11.1b). At least two firms have attributed the hack to TraderTraitor, a North Korean state hacker group that has been behind other major crypto thefts, based in part on analysis of the flow of funds. Binance has not said who it thinks is responsible.

Binance said on Thursday (local time) that its initial investigation pointed to the compromise of one engineer’s laptop as the source of the hack. The company has since said it thinks there were additional breaches in the attack.

“This was a complex attack,” Richard Teng, the exchange’s CEO, said in a video on social media. “The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.”

The heist was breathtaking not only for its scope but for its speed, with billions of funds vanishing in only minutes. Cryptocurrency, which runs on a decentralised exchange called blockchain, is supposed to be able to move quickly by design.

“This is not just the biggest hack in crypto. It’s actually the biggest hack in the world, ever,” Ido Ben-Natan, the chief executive of crypto security company Blockaid, said.

According to cyber security firm CrowdStrike, a US$1.5b theft in 2025 from the exchange Bybit – also a cryptocurrency hack eventually attributed to North Korean attackers – was previously the largest single financial theft ever reported.

Some details of the attack, including how the hackers got inside Binance, are still unclear. But because cryptocurrency runs on a decentralised network, all transactions are public. In the hours after the heist, a number of crypto research firms scrambled to trace the apparent flow of funds out of Binance into other cryptocurrency accounts, known in the industry as wallets. At least three companies have released reports detailing their analysis of what happened.

A rush to respond

The US$6.3b theft from Binance kicked off an apparent cat-and-mouse game where the hackers rushed to split the stolen money up among various wallets, according to third-party analysts, knowing that cryptocurrency issuers would attempt to freeze the funds.

The blockchain security company Chainalysis said in a blog post that the volume of transactions suggested that the attackers relied on automated activity to “obscure the trail of funds” by quickly shuffling money in and out of various wallets.

The hackers appeared to swipe funds in a variety of cryptocurrencies, some of them centrally issued by companies, who rushed to lock down hundreds of millions in assets on Binance. Within about an hour, the companies Circle and Tether had frozen about US$971 million and $825 million in their respective stablecoins – a kind of digital dollar that is pegged to a secure asset such as the US dollar.

Binance has since said that about US$3b of the stolen funds were frozen by various partners, preventing the hackers from transferring them further.

But the traditional model of cryptocurrencies, like bitcoin, live out in the wild on completely decentralised networks where it’s not possible to pull the plug. TRM Labs, a blockchain intelligence company, said it observed the hackers racing to convert their loot into these non-freezable cryptocurrencies, by seeking out loan platforms or “market-makers” that would make the switch.

In all, at least US$2.4b appears to be “beyond any issuer’s reach”, TRM Labs said.

Binance has said it will refund customers through a combination of its own funds and a US$1b bitcoin reserve designed to cover hacking incidents and other emergencies.

The company said in a statement on social media on Saturday (local time) that it has already set aside the funds to cover 90% of the hacked losses and is committed to covering the remaining 10%.

The exchange has paused withdrawals while it conducts security checks.

The hack comes during heightened fears of cyber attacks enabled by powerful artificial intelligence systems. While it’s not clear that the Binance hackers used artificial intelligence (AI), cryptocurrency is a fast-moving industry where “they’re basically building the plane as they’re flying it” Benjamin Cole, a professor at Fordham University, said.

“Basically across every endpoint on the internet at this point – companies of every stripe, be they crypto or not – there’s a growing sense that there is a new cyber security reality in play,” Eric Jardine, the head of research at Chainalysis, said.

A hack-prone system

The hack underscores several characteristics of cryptocurrency, envisioned by enthusiasts as a liberating substitute for the traditional financial system. Instead of banks and governments managing accounts and regulating currencies, cryptocurrency can move from user to user in a decentralised manner.

But that also means that cryptocurrency platforms do not always employ the traditional safeguards expected of banks or other financial institutions. Accounts are usually identified by a key-smash string of letters and numbers and do not necessarily require identity verification. An investor who loses the password to their wallet might have no way to salvage the funds.

And despite efforts to move cryptocurrency into the mainstream, those characteristics have made the technology an attractive opportunity for criminals, terrorist groups and other actors who might otherwise be barred from banks.

While Binance has not said who it thinks is responsible for the hack, two cyber security firms attribute it to TraderTraitor. Chainalysis, one of the firms, said it observed money stolen from Binance co-mingling with funds from a US$388m heist of a different cryptocurrency exchange last month that was also attributed to North Korean attackers.

In all, TRM Labs estimates that North Korean hackers have stolen US$12.8b in cryptocurrency over more than 100 incidents since 2017 (the country’s estimated domestic gross product in 2025 was about US$26b). TraderTraitor has been identified as the cause for previous major crypto hacks, including the US$1.5b theft from Bybit. That heist, too, was executed in only minutes.

Binance has faced a number of legal issues. In 2023, its chief executive, Changpeng Zhao, pleaded guilty to violating criminal anti-money-laundering guidelines meant to prevent illicit transactions. The company also pleaded guilty to criminal charges after prosecutors accused it of allowing transactions from al-Qaeda, the Islamic State, Hamas and other groups. Binance said at the time it took responsibility “for this past chapter”.

Zhao, who stepped down as chief executive, was pardoned by US President Donald Trump, whose Administration said the crypto executive was unfairly targeted by the Biden Administration. The company was also fined US$4.3b.

Binance has no official headquarters and was founded in China in 2017. Binance.US, its American version, said it was not affected.

Binance said it is co-ordinating with global law enforcement and several US agencies said they were aware of the hack or investigating it.

“Secret Service investigators are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace, and recover funds stolen from Binance on Thursday,” Secret Service spokesman Thomas Lynch said in a statement. The Secret Service, in addition to protecting the president, also investigates cyber crimes.

But even with some funds recovered, the hack appears to be a record-setting heist.

“With a couple hundred elite hackers, they’re far exceeding the revenues of the things North Korea used to sell,” Nick Carlsen, an investigator at TRM Labs, said of TraderTraitor. “This is just basically the North Korean Government’s primary source of hard currency revenue now.”