Hackers Steal $6.3 Billion from Binance in Record Crypto Heist

Hackers stole $6.36 billion from Binance customer accounts in the largest digital coin theft in history. Blockchain analysts noted that the attacker spent at least a day and a half testing tools on public ledgers before draining most of the funds from platform wallets in about 20 minutes.

Security firms TRM and Chainalysis linked the attack to TraderTraitor, a hacking group from North Korea. Early checks by Binance pointed to a compromised laptop belonging to a worker in its tech team. That laptop let an attacker reach a service container and push transfers it had not approved. Binance co-CEO Richard Teng later stated that the event involved a more complex attack process rather than a single-step breach. Later checks found extra points of entry, but the investigation has not named anyone responsible.

As investigators trace the stolen assets, about $3 billion of the impacted funds have been frozen so far. The U.S. Secret Service is working with private partners to track down and recover this money. That freezing effort stands apart from Binance using its emergency fund and company money to pay back customer balances. The company CEO reported that 90 percent of the lost assets have already been replaced through these company funds. The remaining 10 percent consists of tokens that are harder to trade quickly, which the company states may take more time to buy.

While the platform works to restore those balances, the company says withdrawals remain on track to reopen on Sunday. In response to the breach, the company cut off access for the risky address and stopped all customer deposits and payouts. Security experts warn that criminals often use major breaches to launch phishing scams. They advise users to ignore unverified links or fake refund offers while account access is paused.

Summary

The massive theft shows how sophisticated attackers can spend a day and a half preparing tools before draining platform wallets in about 20 minutes. While Binance plans to cover all losses and reopen withdrawals, the incident leaves open questions about how a compromised laptop and later-discovered entry points allowed hackers to access withdrawal systems.