Experts say $6.3B Binance heist is largest known theft ever

Attackers entered through an engineer’s laptop before draining hot wallets

Binance, the world’s largest cryptocurrency exchange, has been hit by a $6.3bn heist that, according to experts, is likely the work of North Korea. Elliptic, a consultancy specialising in crypto-related crime, said the theft is more than four times bigger than the previous largest crypto hack — the $1.5bn attack that hit the Bybit exchange last year — and that nothing comparable appears to exist from the pre-crypto era.

“This incident is almost certainly the single largest known theft of any kind,” Tom Robinson, Elliptic’s chief scientist, said. “Before Bybit, that record was held by Saddam Hussein, who took $1bn from the Central Bank of Iraq in Baghdad on the eve of the 2003 Iraq War. The Binance theft is more than six times larger.”

It does not appear that the attackers cracked private keys, the long passwords that control cryptocurrency funds. Instead, a Binance engineer’s laptop was infiltrated, giving the attackers a route into the exchange’s internal systems. “Hackers rarely crack the cryptographic keys themselves,” Robinson said. “They instead target people with access to those wallets. Binance says the attack involved a compromised engineer’s laptop, along with other points of breach. This gave the attacker a way into Binance’s internal systems. From there, they made Binance’s own systems sign transactions that sent the funds to the attacker.”

The funds were drained from Binance’s “hot” wallets — the portion of customer holdings kept connected to the internet for quick withdrawals — rather than its offline “cold” wallets. More than $2.5bn of the $6.3bn taken was withdrawn in one transaction alone.

Elliptic and two other crypto analysis firms have attributed the attack to North Korea, and specifically to a hacking unit the US government calls TraderTraitor. The group emerged from Lazarus, which works from North Korea’s Reconnaissance General Bureau, a military intelligence agency. North Korea, short of cash and hamstrung by sanctions, has a strong track record of crypto hacking; last year TraderTraitor was blamed for the $1.5bn theft from the Dubai-based Bybit. Elliptic said some of the funds taken from Binance have already been traced to wallet addresses used in a crypto exchange hack last month that is also thought to have been carried out by North Korean operatives.

Rafe Pilling, senior director of threat intelligence at cybersecurity firm Sophos, said North Korea had previously hacked conventional financial targets such as the Bangladesh Central Bank and even cash machines, but crypto delivers bigger potential rewards. “Crypto is less well regulated, easier to move, easier to launder and that makes it a more enticing target for North Korea,” Pilling said. “And as a result you have groups like TraderTraitor that are specialising in attacking crypto firms and getting away with huge payments.”

The heist hit the largest exchange in a market that Coingecko, which monitors the industry, says spans more than 22,000 coins worth around $2.7tn. Binance carries out more trades every day than any other platform, at a value of around $95bn daily. The sector is largely unregulated, and any guarantees for customers are coming from Binance itself rather than from regulatory or government-backed safety nets.

Robinson said the breach shows that even the industry’s biggest operator can be reached through a single employee. “Crypto exchanges are safer than they used to be, but not immune to attacks such as this,” he said. “This hack shows that even the biggest exchange can be breached through one employee’s laptop. What matters most for customers is whether the exchange can cover the loss. Binance says it will repay everyone from its own funds.”

Binance said in a post on X that it would “cover all losses” and that “user funds are safe.” It also said it had frozen about half the funds targeted in the hack, stopping the attackers from making off with that tranche.

Crypto users are not covered by formal deposit protections in countries such as the US, UK or Australia if an exchange is hacked or goes bankrupt. Customers of regulated banks, by contrast, are guaranteed capped refunds — up to £120,000 per customer per bank in the UK and $250,000 in the US — but only if the lender goes out of business; the guarantees do not pay out over a hack while the bank keeps operating. In Australia, a capital loss can be claimed on a tax return with proof that a crypto asset was lost or stolen, though most customers otherwise lack legal protections.