Hackers drained $6.36 billion in cryptocurrency from reserves held by Binance, the world's largest crypto exchange, in roughly 20 minutes, making it the largest crypto heist on record. The transfers began at 8:05 p.m. on October 29 in a coordinated attack believed to have originated from TraderTraitor, a hacking unit with links to North Korea.
The same group is also linked to a $1.5 billion hack of the Bybit exchange in February 2025. The US Treasury has previously said that stolen funds of this kind are used to finance North Korea's nuclear missile programme.
Cryptocurrency was built on the idea of decentralisation, meaning no single party controls the money moving across the network. Yet the Binance breach shows that large platforms still rely on a few critical points. Investigators believe one of these was exploited to gain access to a system the exchange uses to authorise transfers out of customers' accounts.
Binance said early investigations indicate the incident may stem from a compromised laptop belonging to an engineer. The cybersecurity firm TRM Labs suggested that preparations for the attack may have begun several days earlier. Binance says it has found no evidence that the private cryptographic keys used to authorise transactions were stolen. Instead, the attackers appear to have gained access to the software that requests withdrawals, potentially allowing them to instruct the exchange's own systems to approve the transfers.
The investigation is continuing, and the firm has said in a subsequent statement that there may have been additional points of breach.
Alan Woodward of the University of Surrey, UK, said a single developer's computer should not be able to compromise an entire exchange. "I don't understand how that can happen," he said. Woodward noted that banks typically use safeguards such as two-person rules, which require two separate people to approve changes to critical systems. "It doesn't look like those were in place," he said.
Clive Summerfield of FARx, a cybersecurity company, said the episode shows the risks of centralisation. "You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened," he said. "Most crypto platforms are as centralised as any bank, with a small number of privileged individuals controlling billions. The difference is that once crypto is transferred, it's gone."
Centralisation has also helped limit the damage in some cases. Stablecoin issuers Tether and Circle were able to freeze billions of dollars of stolen coins, stopping hackers from moving about half of the stolen funds any further.
11
