World’s largest crypto exchange hit by world’s largest heist

Binance Faces Unprecedented Crypto Theft as Investigators Focus on North Korea

Sandego.net – More than $6 billion in cryptocurrency was stolen from Binance on Thursday in what appears to be the largest digital-asset theft ever disclosed. The attack targeted wallets controlled by the world’s biggest cryptocurrency exchange and immediately triggered a race among exchanges, blockchain-monitoring firms and investigators to stop the assets from being moved or converted.

By Thursday night in the United States, cryptocurrency companies had frozen roughly $3 billion connected to the theft. That represents a significant portion of the stolen holdings, but investigators face a continuing challenge as the attackers attempt to transfer funds through different blockchain networks and potential laundering channels.

Engineer’s Laptop Identified in Initial Review

Binance said its early investigation found that the breach involved an engineer’s laptop. The compromised device gave an attacker access to a service container, enabling unauthorized withdrawal transactions to be submitted.

“[It] allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

The exchange said customers would not bear the losses. Binance said it plans to reimburse affected balances using company resources and its emergency asset fund, while maintaining that user funds remain protected.

Deposits and withdrawals were temporarily halted while security reviews continued. Binance also revoked authorization for the affected address and said it had brought in law enforcement agencies and blockchain-intelligence partners to trace and recover the stolen cryptocurrency.

Record Amount Draws Immediate Alarm

The scale of the breach stunned participants across the crypto industry. Aravind Srinivasan, who leads the systematic over-the-counter business at major crypto market maker GSR, described it to Reuters as the largest hack ever.

“It’s the biggest hack in history.”

Several blockchain-analysis groups have linked the operation to North Korea with varying degrees of confidence. TRM Labs attributed the theft to an elite North Korean hacking group, citing both blockchain evidence and intelligence gathered beyond the public ledger. Singapore-based Pangolin Intelligence reached a similar conclusion after examining the movement of funds and comparing it with previous incidents tied to North Korean cyber operators.

An analyst at Pangolin Intelligence said the recovery effort may only be entering its first phase. North Korea could seek to use a broad network of money-laundering organizations to turn the stolen cryptocurrency into spendable funds, making continued coordination among exchanges especially important.

“I think the cat and mouse game has barely begun yet.”

Chainalysis said it was tracking the stolen assets as they moved across multiple blockchains, including Bitcoin and Ethereum. A spokesperson for the company said it had high confidence that North Korea was responsible.

Why Moving Stolen Crypto Remains Difficult

Cryptocurrency transactions can be transferred rapidly, but major public blockchains also leave a permanent record of wallet activity. That transparency can help investigators identify and flag addresses associated with stolen money. Exchanges and other service providers may then freeze assets when they reach platforms that can be identified and contacted.

Still, tracing a transaction does not guarantee recovery. Attackers can split holdings into many transfers, bridge them to other networks, or route them through intermediaries. The ability to freeze approximately half of the stolen total so quickly highlights both the scale of the response and the urgency of preventing further movement.

US authorities have been asked for comment, including the FBI and the Secret Service, both of which investigate cybercrime. In earlier large cryptocurrency theft cases, FBI specialists have worked with private-sector analysts and exchanges to block or seize a portion of stolen assets. North Korea’s mission to the United Nations has also been contacted. Pyongyang has rejected hacking accusations in the past.

North Korea’s Long Record of Crypto Operations

If confirmed, North Korean involvement would fit a pattern already familiar to US law enforcement and private cybersecurity researchers. Hackers associated with the country were blamed for the previous record cryptocurrency theft: the alleged $1.5 billion attack on Bybit, another major exchange.

That earlier theft underscored the financial importance of cyber operations for a heavily sanctioned state. Current and former US and South Korean officials have described North Korea’s hacking units as an important revenue source for the nuclear-armed government. United Nations findings and private-sector research have documented billions of dollars in alleged thefts from banks and cryptocurrency businesses over recent years.

A 2023 investigation illustrated that recovery remains possible even after stolen cryptocurrency changes hands. South Korea’s intelligence service worked with private tracking specialists to seize about $1 million in digital assets stolen by North Korean operators from a victim.

Exchange Security Under Fresh Scrutiny

Cryptocurrency exchanges often hold assets for customers, unlike stock-trading platforms where holdings are generally maintained through a more established network of brokers, custodians and clearing systems. That custody role makes exchanges attractive targets for attackers seeking a single breach capable of reaching substantial value.

The industry has also developed rapidly while regulatory oversight has varied widely across jurisdictions. Security practices, wallet controls and incident-response procedures have become central concerns for users deciding where to keep digital assets.

Binance was created in 2017 by Canadian national Chaopeng Zhao and became the leading cryptocurrency trading platform globally within its first year. Zhao left his leadership role in 2023 after pleading guilty in the United States to violations of anti-money-laundering laws. He received a four-month federal prison sentence and was pardoned by President Donald Trump in October last year.

Zhao no longer runs Binance, though he remains its largest shareholder. In a post on X, he said the event appeared to be a hack and indicated that he expected customer funds to remain protected as the company worked through the incident.