It took just 20 minutes for $6.3 billion, equivalent to approximately €5.6 billion, to disappear. Binance, the world's largest cryptocurrency exchange, found itself at the centre of the biggest digital asset theft ever recorded. Suspicion has fallen on a hacking unit linked to North Korea, one of the most isolated countries on the planet, where internet access remains tightly controlled by the state.
The attack, which took place on 29 October, exposed weaknesses in the platform's security systems and triggered an international race to trace and freeze the stolen funds.
An attack of historic proportions
It all began on a Thursday, when Binance announced that it had identified a serious security breach. What initially appeared to be yet another cyber incident developed, within hours, into one of the biggest financial scandals in the history of cryptocurrencies.
The attackers managed to withdraw approximately $6.3 billion from several of the company's digital wallets, an amount more than four times greater than the sum stolen from Bybit in 2025.
The scale of the attack took cybersecurity experts by surprise, particularly the speed with which the criminals managed to move billions of dollars across different digital networks.
A compromised computer opened the door to the theft
Initial investigations pointed to a Binance engineer's laptop as a possible entry point for the intruders. The company subsequently acknowledged that other breaches of its systems had also been identified.
According to TRM Labs, a company specialising in the investigation of financial crimes involving cryptoassets, the attackers compromised mechanisms responsible for authorising and signing transactions, enabling them to issue instructions that drained several digital wallets.
Having gained control of the assets, the criminals began transferring the funds across different cryptocurrency networks.
Using decentralised protocols, they sought to convert assets that could be frozen into others less susceptible to being blocked, making it more difficult to recover the money.
Most of the theft was carried out in approximately 20 minutes.
Faced with the seriousness of the situation, Binance temporarily suspended deposits and withdrawals while launching an internal investigation and attempting to prevent further unauthorised transfers.
Suspicions point to North Korea
The investigation into those responsible gained momentum when international blockchain analytics companies began detecting patterns associated with previous operations carried out by North Korean hackers.
TRM Labs and Chainalysis attributed the attack, with a high degree of confidence, to the TraderTraitor group, which is linked to the wider network of cyber operations known as Lazarus.
Their findings are based on an analysis of financial movements and other intelligence gathered during the investigations. Chainalysis also identified links between the funds stolen from Binance and assets originating from an earlier attack on the Bitget platform.
Despite this evidence, the attribution does not amount to a definitive judicial finding.
The regime led by Kim Jong Un has repeatedly been accused of using illegal cyber operations to generate financial resources. Pyongyang, however, denies allegations of state involvement in activities of this kind.
A digital warfare machine powered by talent
The operational capabilities of North Korean hacking groups did not emerge by chance.
For years, international authorities, including the FBI, have warned of the existence of specialised networks involved in stealing virtual assets and other forms of cybercrime linked to North Korea.
According to information released by security experts, the country recruits high-achieving students, particularly those specialising in technology, directing some of them towards cyber units linked to state intelligence services.
This strategy enables the regime to develop sophisticated cyber capabilities despite the severe restrictions imposed on internet access for the general population.
Could the theft threaten Binance's survival?
Although $6.3 billion represents an extraordinary sum, Binance's financial scale may allow it to absorb a significant proportion of the consequences.
According to data from the analytics platform DefiLlama cited in the original report, the company held approximately $137 billion in assets.
Nevertheless, the incident raises questions about the security of the systems used by major cryptocurrency exchanges and the mechanisms in place to protect customer deposits.
The concern extends beyond the missing money. Also at stake is investor confidence in an industry that continues to face highly sophisticated cyberattacks.
Who will bear the losses?
Binance has assured customers that it intends to cover the losses resulting from the attack using its own resources and its user protection fund, known as SAFU.
Established in 2018, the fund serves as a financial reserve designed to respond to exceptional circumstances, including serious security breaches.
However, the fund's capacity is smaller than the total amount stolen. Fully covering the losses will therefore require the company to mobilise additional financial resources.
Meanwhile, recovering the assets has become a priority. On 30 October, Chainalysis reported that approximately $2.8 billion had been frozen in an operation involving investigators, industry companies and cryptocurrency issuers.
The battle to recover the remaining funds remains complex, particularly after some of the stolen assets were converted into cryptocurrencies that are more difficult to freeze.
Binance, however, continues to stand by its promise to shoulder the financial consequences of the attack and protect its users.
The episode highlights a disturbing reality: in an economy increasingly dependent on digital systems, a security breach can turn just a few minutes into billions of dollars in losses.
