Hackers pilfered $6.3 billion from the world’s largest cryptocurrency exchange Thursday in a stunning attack that halted withdrawals on the platform and set off a race among digital currency companies to freeze billions in stolen funds.
The main thrust of the attack on Binance took about 20 minutes, according to third-party cybersecurity firms who examined public flows of cryptocurrency in and out of the exchange.
It remains unclear how the hackers managed to breach the systems of Binance. At least two firms have attributed the hack to TraderTraitor, a North Korean state hacker group that has been behind other major crypto thefts, based in part on analysis of the flow of funds. Binance has not said who it thinks is responsible.
Binance said Thursday that its initial investigation pointed to the compromise of one engineer’s laptop as the source of the hack. The company has since said it thinks there were additional breaches in the attack.
“This was a complex attack,” Richard Teng, the exchange’s CEO, said in a video on social media. “The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.”
The heist was breathtaking not only for its scope but for its speed, with billions of funds vanishing in only minutes. Cryptocurrency, which runs on a decentralized exchange called blockchain, is supposed to be able to move quickly by design.
“This is not just the biggest hack in crypto. It’s actually the biggest hack in the world, ever,” said Ido Ben-Natan, the CEO of crypto security company Blockaid.
According to cybersecurity firm CrowdStrike, a $1.5 billion theft in 2025 from the exchange Bybit — also a cryptocurrency hack eventually attributed to North Korean attackers — was previously the largest single financial theft ever reported.
Some details of the attack, including how the hackers got inside Binance, are still unclear. But because cryptocurrency runs on a decentralized network, all transactions are public. In the hours after the heist, a number of crypto research firms scrambled to trace the apparent flow of funds out of Binance into other cryptocurrency accounts, known in the industry as wallets. At least three companies have released reports detailing their analysis of what happened.
A rush to respond
The $6.3 billion theft from Binance kicked off an apparent cat-and-mouse game where the hackers rushed to split the stolen money up among various wallets, according to third-party analysts, knowing that cryptocurrency issuers would attempt to freeze the funds.
The blockchain security company Chainalysis said in a blog post that the volume of transactions suggested that the attackers relied on automated activity to “obscure the trail of funds” by quickly shuffling money in and out of various wallets.
The hackers appeared to swipe funds in a variety of cryptocurrencies, some of them centrally issued by companies, who rushed to lock down hundreds of millions in assets on Binance. Within about an hour, the companies Circle and Tether had frozen about $971 million and $825 million in their respective stablecoins — a kind of digital dollar that is pegged to a secure asset such as the U.S. dollar.
Binance has since said that about $3 billion of the stolen funds were frozen by various partners, preventing the hackers from transferring them further.
But the traditional model of cryptocurrencies, like bitcoin, live out in the wild on completely decentralized networks where it’s not possible to pull the plug. TRM Labs, a blockchain intelligence company, said it observed the hackers racing to convert their loot into these non-freezable cryptocurrencies, by seeking out loan platforms or “market-makers” that would make the switch.
In all, at least $2.4 billion appears to be “beyond any issuer’s reach,” according to TRM Labs.
Binance has said it will make customers whole through a combination of its own funds and a $1 billion bitcoin reserve designed to cover hacking incidents and other emergencies. The exchange has paused withdrawals while it conducts security checks.
The hack comes during heightened fears of cyberattacks enabled by powerful artificial intelligence systems. While it’s not clear that the Binance hackers used AI, cryptocurrency is a fast-moving industry where “they’re basically building the plane as they’re flying it,” said Benjamin Cole, a professor at Fordham University.
“Basically across every endpoint on the internet at this point — companies of every stripe, be they crypto or not — there’s a growing sense that there is a new cybersecurity reality in play,” said Eric Jardine, the head of research at Chainalysis.
A hack-prone system
The hack underscores several characteristics of cryptocurrency, envisioned by enthusiasts as a liberating substitute for the traditional financial system. Instead of banks and governments managing accounts and regulating currencies, cryptocurrency can move from user to user in a decentralized manner.
But that also means that cryptocurrency platforms do not always employ the traditional safeguards expected of banks or other financial institutions. Accounts are usually identified by a key-smash string of letters and numbers and do not necessarily require identity verification. An investor who loses the password to their wallet might have no way to salvage the funds.
And despite efforts to move cryptocurrency into the mainstream, those characteristics have made the technology an attractive opportunity for criminals, terrorist groups and other actors who might otherwise be barred from banks.
While Binance has not said who it thinks is responsible for the hack, two cybersecurity firms attribute it to TraderTraitor. Chainalysis, one of the firms, said it observed money stolen from Binance commingling with funds from a $388 million heist of a different cryptocurrency exchange last month that was also attributed to North Korean attackers.
In all, TRM Labs estimates that North Korean hackers have stolen $12.8 billion in cryptocurrency over more than 100 incidents since 2017 (the country’s estimated domestic gross product in 2025 was about $26 billion). TraderTraitor has been identified as the cause for previous major crypto hacks, including the $1.5 billion theft from Bybit. That heist, too, was executed in only minutes.
Binance has faced a number of legal issues. In 2023, its CEO, Changpeng Zhao, pleaded guilty to violating criminal anti-money-laundering guidelines meant to prevent illicit transactions. The company also pleaded guilty to criminal charges after prosecutors accused it of allowing transactions from al-Qaeda, the Islamic State, Hamas and other groups. Binance said at the time it took responsibility “for this past chapter.”
Zhao, who stepped down as CEO, was pardoned by Trump, whose administration said the crypto executive was unfairly targeted by the Biden administration. The company was also fined $4.3 billion.
Binance has no official headquarters and was founded in China in 2017. Binance.US, its American version, said it was not affected.
Binance said it is coordinating with global law enforcement, and several U.S. agencies said they were aware of the hack or investigating it.
“Secret Service investigators are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace, and recover funds stolen from Binance on Thursday,” Secret Service spokesman Thomas Lynch said in a statement. The Secret Service, in addition to protecting the president, also investigates cybercrimes.
But even with some funds recovered, the hack appears to be a record-setting heist.
“With a couple hundred elite hackers, they’re far exceeding the revenues of the things North Korea used to sell,” Nick Carlsen, an investigator at TRM Labs, said of TraderTraitor. “This is just basically the North Korean government’s primary source of hard currency revenue now.”
The post How suspected North Korean hackers swiped billions in crypto in only minutes appeared first on Washington Post.
