The world's largest cryptocurrency exchange has suffered a $6.3bn theft that specialists believe ranks as the largest heist of any kind ever recorded. According to The Guardian, the attack has been attributed to a North Korean hacking unit, marking a significant escalation in state-sponsored cyber theft targeting digital assets. The exchange has committed to covering all losses from its own reserves, though the incident raises serious questions about the security of cryptocurrency holdings and the vulnerability of even the largest platforms.
This represents far more than a routine cybercrime. According to Elliptic, a consultancy specialising in crypto-related crime, the theft dwarfs all previous known thefts. It exceeds the previous largest crypto hack—a $1.5bn breach at Bybit—by more than four times, and Tom Robinson, Elliptic's chief scientist, notes that
"This incident is almost certainly the single largest known theft of any kind. Before Bybit, that record was held by Saddam Hussein, who took $1bn from the central bank of Iraq in Baghdad on the eve of the 2003 Iraq war. The Binance theft is more than six times larger."
What exactly is cryptocurrency?
Cryptocurrency operates as a digital asset entirely outside the traditional banking system, with no physical form. Bitcoin, the most widely recognised cryptocurrency, alongside peers such as Ethereum, Ripple and Dogecoin, functions through a combination of encryption technology—similar to what secures messaging applications—and peer-to-peer networks that allow computers to communicate without requiring a central server, much like the music-sharing platforms that emerged in the late 1990s.
Each bitcoin owner holds access to a private key, essentially a lengthy password required to retrieve funds. These transactions are permanently recorded on a publicly visible ledger called a blockchain, functioning similarly to a school register. Owners typically store their private keys in a "crypto wallet". Coingecko, which tracks the market, identifies more than 22,000 different cryptocurrencies in existence. The entire sector is valued at approximately $2.7tn, making it an attractive target for hackers and financially desperate states seeking to circumvent international sanctions and regulatory oversight.
How do cryptocurrency exchanges operate?
A cryptocurrency exchange serves as a marketplace where individuals buy, sell and trade digital assets like bitcoin. These platforms host customer crypto wallets, typically stored in "cold" configurations—disconnected from the internet to provide stronger protection against theft. A smaller portion of funds sits in "hot" wallets, which remain connected to the internet to facilitate rapid withdrawals, making them considerably more vulnerable to attackers. Binance, the world's largest exchange by daily trading volume, processes approximately $95bn in transactions each day.
What was the mechanism of the Binance attack?
The breach did not involve direct compromise of private cryptographic keys. Instead, attackers infiltrated a Binance engineer's laptop, gaining access to internal systems and enabling unauthorised withdrawals from hot wallets. According to CBS News, Binance's initial investigation identified a compromised engineer's laptop that gave attackers access to a service container, with the company later reporting additional "points of breach" in its infrastructure.
Tom Robinson explains the typical approach:
"Hackers rarely crack the cryptographic keys themselves. They instead target people with access to those wallets. Binance says the attack involved a compromised engineer's laptop, along with other points of breach. This gave the attacker a way into Binance's internal systems. From there, they made Binance's own systems sign transactions that sent the funds to the attacker."More than $2.5bn of the total $6.3bn was extracted in a single transaction. According to TRM Labs reporting to CBS News, attackers moved approximately $6.36bn from Binance wallets across 10 blockchains, with the majority of transfers occurring within roughly 20 minutes.
Robinson adds that
"Crypto exchanges are safer than they used to be, but not immune to attacks such as this. This hack shows that even the biggest exchange can be breached through one employee's laptop. What matters most for customers is whether the exchange can cover the loss. Binance says it will repay everyone from its own funds."
How do thieves convert stolen cryptocurrency into usable funds?
Perpetrators must "cash out" the cryptocurrency by converting it into legitimate fiat currency—traditional money issued by governments. Chainalysis, a crypto research firm, has identified that the attackers employed "never seen before" laundering patterns to move the stolen assets. Phil Larratt, a senior director at Chainalysis, explains that the conversion process is deliberately protracted:
"The process is patient and sophisticated,"potentially requiring weeks, months or even years to complete.
Criminals typically employ several methods to obscure the origin of stolen funds. These include depositing assets on less regulated exchanges, utilising swapping services that exchange one cryptocurrency for another, and engaging brokers willing to convert digital assets to cash in exchange for a percentage of the proceeds. The complexity of moving funds across multiple blockchains further complicates law enforcement efforts to trace and recover the stolen assets.
Who is responsible for the theft?
The attack has been attributed to TraderTraitor, a North Korean hacking unit designated by the United States government. The communist state, constrained by international sanctions and chronic cash shortages, maintains a well-documented history of cryptocurrency theft. TraderTraitor emerged from Lazarus, an operation run by North Korea's Reconnaissance General Bureau, a military intelligence agency.
Last year, TraderTraitor was blamed for the $1.5bn theft from Bybit, a Dubai-based exchange. Elliptic and two additional crypto analysis firms have attributed the current attack to North Korea, with Elliptic noting that some funds taken from Binance have already been traced to wallet addresses involved in a cryptocurrency exchange hack last month also believed to have been executed by North Korean operatives. According to the FBI's attribution reported by CBS News, the bureau has confirmed the attack was carried out by North Korea and its TraderTraitor unit.
Rafe Pilling, senior director of threat intelligence at cybersecurity firm Sophos, notes that North Korea has previously targeted conventional financial institutions including the Bangladesh Central Bank. However, cryptocurrency presents substantially more attractive targets.
"Crypto is less well regulated, easier to move, easier to launder and that makes it a more enticing target for North Korea. And as a result you have groups like TraderTraitor that are specialising in attacking crypto firms and getting away with huge payments."
What recovery efforts are underway?
Stablecoin issuers have taken swift action to freeze stolen assets. According to Reuters, Tether froze nearly $1.57bn linked to the incident, while Circle froze more than $800m. However, Reuters also reported that stablecoin issuers collectively froze approximately half the stolen assets, with TRM Labs estimating that roughly $2.4bn in bitcoin and ether remained beyond immediate reach.
Binance stated it was collaborating with law enforcement and blockchain-intelligence partners to trace and recover funds while investigating the breach. The exchange announced it would resume withdrawal services within 45 hours of its initial announcement, according to Reuters reporting.
Are cryptocurrency investments protected?
Any financial guarantees stem exclusively from Binance itself rather than from regulatory bodies or government-backed safety mechanisms. The exchange announced it would "cover all losses" and that "user funds are safe". Binance also reported freezing approximately half the funds targeted in the hack, preventing thieves from accessing that portion of cryptocurrency.
In Australia, individuals may claim a capital loss on tax returns if they provide evidence that a crypto asset was lost or stolen. However, most customers lack meaningful legal protections. Cryptocurrency users in countries including the United States, United Kingdom and Australia are not covered by formal deposit insurance if an exchange is hacked or becomes insolvent.
By contrast, customers of regulated banks receive guaranteed capped refunds—up to £120,000 per customer per bank in the UK and $250,000 in the US—but only if the financial institution fails. These protections do not apply to losses resulting from hacks when the bank continues operating. This regulatory gap underscores the substantially higher risk profile of cryptocurrency holdings compared to traditional banking.
