North Korea-linked hackers drain $6.3 billion from Binance in 20-minute heist

What happened

On October 29, starting at around 4pm ET, attackers began draining wallets belonging to Binance, the world's largest cryptocurrency exchange. Within roughly 20 minutes, about $6.3 billion in crypto had been siphoned off, spread across at least ten blockchains including Ethereum, Bitcoin, Tron and Solana, according to analysis by blockchain forensics firm TRM Labs. WIRED reports that investigators treat it as the largest crypto heist ever recorded.

Binance suspended all deposits and withdrawals almost immediately. According to TechCrunch, the company said intruders entered its network through a compromised engineer's laptop, which allowed the attacker to reach a service container and submit unauthorized withdrawal transactions. Binance says it has seen no evidence that its private keys were leaked, and it has committed to covering all losses from the incident.

A rehearsed, automated operation

TRM Labs says preparation began at least 36 hours before the theft. The attacker's wallet first received small test withdrawals, and on the morning of October 29 the operator deployed and tested attack code on separate wallets. Four hours after a final rehearsal, the same code was installed on a Binance hot wallet — the internet-connected wallets exchanges use to process customer withdrawals — and the funds were drained from hot wallets across the affected chains.

WIRED reports that Binance initially pointed to a compromised laptop, but later said its investigation had uncovered additional points of breach, describing it as a complex attack being worked in coordination with law enforcement.

Chainalysis says its investigators watched, in real time, stolen Binance funds commingling with money taken in the recent Bitget exchange exploit, which had been attributed to North Korean actors. TechCrunch, citing Elliptic, puts the Bitget loss at $351 million. Chainalysis also reports money-laundering patterns it has not seen before, with thousands of rapid transactions suggesting automation is being used to obscure the trail of funds.

North Korea blamed, but not by Binance

TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korean unit that specializes in infrequent but high-profile crypto thefts. Tom Robinson, chief scientist and cofounder of Elliptic, told WIRED that North Korea is the likely culprit, though Elliptic has not specifically tied the operation to TraderTraitor. He noted that if the attribution holds, this single theft would nearly double everything the regime has stolen in crypto to date.

Elliptic points to several hallmarks: the targeting of a crypto company employee's laptop, wallet funding through Tornado Cash, and a rehearsed attack, echoing the Bybit exchange heist. TraderTraitor was named by the FBI as responsible for that earlier attack — WIRED describes it as a $1.5 billion theft, while TechCrunch reports $1.4 billion, which would make it the second-largest heist on record. The two outlets also differ on when the Bitget theft occurred. Neither Binance nor law enforcement has publicly endorsed the North Korea link.

Roughly half the funds frozen

About half of the stolen crypto has been frozen. According to Robinson, around $2.8 billion — roughly 44 percent of the total, almost all of it stablecoins — has been frozen by crypto companies and exchanges. The remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze on-chain; it can only be intercepted when it reaches an exchange or other service. Robinson expects some of it to be caught over the coming months but does not expect the frozen share to rise much further.

Binance has said user funds are safe, but per TechCrunch it provided no immediate proof and said it would publish an updated proof of reserves once remediation is complete. The company also faces questions about why a single employee's laptop could access systems capable of controlling billions of dollars in funds, and whether third-party security audits of its network were performed before the breach.

Why it matters

This is by far the largest cryptocurrency theft in history, several times larger than the previous record, and it shows that even the industry's biggest exchange could be undone through a single compromised endpoint. It also exposes the hard limits of post-theft defense: stablecoins can be frozen at the issuer, but Bitcoin, Ether and XRP cannot, meaning billions may remain in attackers' hands indefinitely. If North Korean involvement is confirmed, the theft would roughly double the regime's crypto proceeds — funds researchers say finance its sanctioned weapons programs. Expect sharper regulatory scrutiny of exchange security, hot wallet practices and employee device risk across the crypto industry.