Investigators say several factors may have been involved, including a compromised DevOps engineer’s laptop, with signs pointing to North Korean actors being responsible.
Investigators are looking into how hackers stole $6.3 billion (€5.6 billion) from cryptocurrency exchange Binance in what is being described as the “biggest hack in history”, with signs suggesting a North Korean hacking group was behind the attack.
ADVERTISEMENT
ADVERTISEMENT
The figures involved dwarf those of previous crypto hacks, such as Bybit ($1.5 billion, €1.39 billion), Poly Network ($610 million, €545 million) and Ronin Network ($540 million, €482 million). The Binance incident is the latest in a series of cybersecurity incidents this October, with the expanding use of AI to find vulnerabilities largely being blamed by cybersecurity experts.
Binance is the world’s largest cryptocurrency exchange, controlling roughly 35% of the total crypto market share, according to the company. It functions as a key pillar of the crypto ecosystem, allowing people to buy and sell cryptocurrencies.
Like traditional currency exchanges, it keeps its customers’ coins in wallets it controls and processes withdrawals from a few of those wallets that stay online all the time.
The attack took place in just under four hours, as hackers gained access to several wallets via a compromised laptop and sent the funds from Binance's wallets to their own. Fortunately, Binance and its partners managed to freeze $2.7 billion (€2.4 billion) of the stolen funds, but the remaining funds sits untouched in the attacker’s wallets.
Here’s a timeline of how it happened:
Thursday
22:29 CET Binance says it is actively investigating reports of a potential security issue and reassures customers that their funds are “completely safe”, but warns of “scams”.
23:15 CET The company says it is conducting security checks, with withdrawals to resume as soon as the security issue is resolved.
Friday
00:06 CET The company suspends Binance Alpha trading, saying trading will resume once the security issue is resolved. It again reassures customers that their funds remain safe.
00:22 CET Binance makes its first announcement that assets are being affected. The company says it is aware of reports of frozen funds, clarifying that $2.54 billion (€2.26 billion) has currently been frozen. It adds that the figure may rise as it works closely with law enforcement and relevant authorities to trace and freeze assets.
01:13 CET Binance issues a statement saying it will “cover all losses” and that, as a precaution, all deposits and withdrawals have been temporarily suspended.
01:52 CET The company updates the frozen asset figure, which has risen to $3 billion (€2.68 billion).
03:25 CET Binance reveals the total impact is around $6.3 billion (€5.6 billion), with its investigation suggesting a compromised DevOps engineer’s laptop may have been the entry point for an attack that allowed access to a service container and the submission of unauthorised withdrawal transactions.
The company adds that there is no evidence of any wallet private key leak. As a precaution, it has revoked the affected address authorisation and engaged law enforcement and blockchain partners to trace and recover funds, in addition to freezing accounts.
05:36 CET The company says in an update that the incident stems from multiple factors, and not just the compromised laptop.
09:47 CET Binance confirms its previous statement that a compromised laptop may have been the entry point, but says investigators have found other breaches in what was a “complex attack”. The company says it is on track to resume withdrawal services in 45 hours.
11:55 CET The company says it has begun recovering affected assets for users and will cover losses through company funds, with $6.34 billion (€5.66 billion) reserved to cover the incident.
“We will weather this storm,” says the company on social media platform X.
How did they do it?
Binance has said the incident was a “complex attack” that stemmed from multiple factors.
Its initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
Blockchain data infrastructure company Bitquery reports that Binance’s own withdrawal system signed away $6.3 billion (€5.6 billion) from 17 of its hot wallets in just under four hours, from Thursday night at 21:04 to 00:56 CET on Friday morning.
This prompted stablecoin issuers Tether, Circle and Arbitrum, along with four smaller issuers, to freeze $2.7 billion to prevent the funds from being stolen, says Bitquery, while Bitcoin confirmed that $3 billion had been frozen in total.
The attacker swapped another $729 million of stablecoins before the freezes began. In the end, the attacker still held roughly $3.1 billion, mostly in Ether and Bitcoin, according to Bitquery.
Bitquery also reports that the funds were sent to new addresses across nine blockchains, with Ethereum, Bitcoin and TRON hit hardest.
The company is still investigating the issue in liaison with law enforcement and blockchain intelligence partners to trace and recover funds.
Binance has temporarily suspended deposits and withdrawals while security checks are completed, revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds.
The company has said it will publish a detailed technical post-mortem after the investigation is complete and the facts have been verified.
It also plans to publish an updated Proof of Reserves after remediation is complete.
Who was behind it?
Blockchain intelligence and cybersecurity firm TRM Labs claims that TraderTraitor, a North Korean hacking group, was behind the attack.
“Based on robust on- and off-chain intelligence, we make this judgment with high confidence,” the company said in a statement.
It also points out that the FBI named the same group as responsible for the $1.5 billion (€1.34 billion) Bybit hack in February 2025.
