In February 2025, a team of North Korean hackers stole $1.5 billion from the cryptocurrency exchange Bybit — a dark day for the industry and the largest crypto heist ever recorded.
Now that number looks paltry.
Binance, the world’s biggest crypto exchange, set an unwanted record on Thursday, losing $6.3 billion to hackers in an eye-popping attack that highlighted the deep vulnerabilities in crypto’s financial infrastructure.
For years, the industry has struggled to prevent thefts. Now, the risks are growing even more extreme as attackers use artificial intelligence and other advanced techniques to steal funds and quickly launder them, crypto analysts and security experts said.
The Binance attacker used “laundering patterns we have not seen before,” the crypto analytics firm Chainalysis wrote in a blog post on Friday. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
The details of how Binance was breached are still coming into focus. Both Chainalysis and TRM Labs, another analytics firm, attributed the hack to North Korea, which has targeted crypto companies for years. Binance initially said that the attacker appeared to have compromised a laptop belonging to one of its engineers, before clarifying that further investigation had uncovered “additional points of breach.”
Binance has promised to make customers whole and said it had set aside more than $6.3 billion in company funds to cover the losses. (Binance processes billions of dollars in transactions every day.) Of the total that was stolen, $3 billion has been frozen by other companies, including Circle and Tether, two large issuers of digital coins that have the ability to stop the movement of stolen funds.
That means North Korea won’t have access to those coins, and Binance said it was working on recovering them. But the hackers have already moved $2.4 billion in crypto “beyond any issuer’s reach,” according to TRM.
Those losses may be only the beginning, as the crypto world reckons with an era of fast-evolving hacking techniques and growing risks. Even as President Trump has endorsed the industry and sought to bring it into the mainstream, some crypto firms still struggle with the basic work of any financial company — keeping customer money safe.
“A.I. is undoubtedly turbocharging the ability of hackers to find and exploit subtle flaws in various parts of the crypto ecosystem,” said Eswar Prasad, a Cornell University economics professor who tracks the crypto industry. “The scale and scope of such attacks is likely to intensify.”
Still, North Korea’s inventive army of hackers could probably have pulled off the Binance heist without A.I., even if the technology proved useful during the operation, some cybersecurity experts said.
“North Korea had sophisticated threat actors that could have done this pre-A.I.,” said Joshua Saxe, the chief technology officer of the A.I. security firm Abundant Security. “That said, it’s hard not to think about the relationship between mega-heists like this and what A.I. is doing to democratize advanced hacking. Many more actors can attempt this kind of thing now, thanks to A.I. tools.”
Crypto has struggled with major thefts since the technology’s inception in 2008.Industry pioneers viewed digital coins as a renegade alternative to banks — a type of money outside the supervision of governments or big businesses. From the beginning, that philosophy made crypto vulnerable.
Many crypto investors keep funds in their own online wallets. But if they lose a password, the money is gone forever. Others rely on exchanges like Binance, which behave something like banks, storing funds for customers. But exchanges are not subject to the same regulatory systems that govern banks and other traditional financial companies, and have often lacked effective guardrails against crime.
In February 2025, North Korean hackers tricked the chief executive of Bybit, Ben Zhou, into authorizing a seemingly routine transaction that handed them control of the exchange’s system. They had exploited a gaping hole in ByBit’s defenses — a free software product that the company used to protect customer deposits. The thieves extracted $1.5 billion in digital coins.
At the time, a security firm called the losses “completely preventable.” Ultimately, Bybit weathered the crisis by drawing on corporate reserves and borrowing funds from other crypto companies.
The attack on Binance appears more serious.
After it was founded in 2017, the exchange quickly became the largest and most important company in the crypto industry, processing as much as two-thirds of all digital currency transactions. It provides a marketplace for people to buy popular coins like Bitcoin and Ether, converting traditional currencies into crypto.
On Thursday, as soon as Binance’s system was breached, its founder, Changpeng Zhao, assured customers that they would not lose any money.
“It hurts, but we will survive,” he wrote on X, adding a muscle emoji.
Mr. Zhao has a long history of legal and regulatory problems. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the U.S. government. After serving a four-month prison sentence, Mr. Zhao was pardoned by Mr. Trump last year. Binance also forged a business relationship with World Liberty Financial, the Trump family’s crypto company.
News of the Binance hack started to spread on social media on Thursday afternoon. Because most crypto transactions are publicly visible, industry analysts tracked sudden withdrawals from the exchange on the blockchain, the ledger of digital currency movements. But while transactions happen openly, the money often moves too quickly for companies to respond, and it can be difficult to determine who controls particular accounts.
The stolen funds began leaving Binance at around 4:20 p.m. on Thursday, according to Chainalysis. Soon the thieves started moving the money in a sequence suggesting “a programmatic process” for laundering funds.
Chainalysis attributed the attack to North Korea partly because it observed stolen Binance funds “commingling” with funds stolen in a hack last month that targeted Bitget, another crypto exchange. In its analysis, TRM said the Binance hack was the work of TraderTraitor, North Korea’s elite hacking unit.
In a statement, the F.B.I. said it was “aware of the incident” and “engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.”
Western intelligence officials for years have warned that crypto theft is one of the main ways that North Korea’s regime evades punishing international sanctions and funds its nuclear weapons program, which it considers crucial to its survival.
The Binance hack appears to be an especially lucrative payday. Tom Robinson, the chief scientist and co-founder of Elliptic, a crypto analytics firm, said it would nearly double the sum of all of North Korea’s known crypto thefts. Mr. Robinson said that Elliptic agreed with other firms that North Korea was probably the culprit, but noted that North Korean groups usually were much faster and more efficient at moving funds and avoiding freezes.
North Korean hackers “know that unlike big banks, crypto exchange security is often terrible,” said Ciaran Martin, the former head of national cyber defense in the United Kingdom. “They’re good at exploiting that.”
He added, “This is their best day at the office yet.”
The post Binance’s $6.3 Billion Hack Is Just the Start of a Risky New Era appeared first on New York Times.
