Investigators: North Korea's Hackers Drained $6.36 Billion From Binance in 20 Minutes, the Biggest Crypto Heist Ever

Somebody walked out of the world's biggest crypto exchange on Thursday with $6.36 billion, and the two firms that track stolen crypto for a living say they know who: North Korea.

Binance, the exchange, confirms the break-in and puts the damage at about $6.3 billion. TRM Labs, a blockchain-tracing firm that works with law enforcement, counted every transfer and found the money left Binance wallets on ten different blockchains, most of it in about 20 minutes. That is the largest crypto theft on record, roughly four times the $1.5 billion stolen from the exchange Bybit in February 2025.

TRM says it has "high confidence" the thief is TraderTraitor, North Korea's top hacking unit and the same crew the FBI blamed for Bybit. Chainalysis, the other big tracing firm, says it reached the same conclusion with "a high degree of confidence."

How a 20-minute heist was 36 hours in the making

TRM's reconstruction reads like a bank-job movie. The thief's main wallet was funded with three small withdrawals from Tornado Cash, a service that hides where crypto came from, starting the morning of Oct. 28. Early on Oct. 29 the attacker deployed the code for the job and tested it on two wallets. Later that day came a full dress rehearsal on a third wallet. Four hours after that, the same code was sitting on a Binance wallet.

The theft itself started Thursday afternoon on the XRP Ledger. In four minutes, five Binance wallets sent 233.46 million XRP to one attacker address. Solana and Optimism followed. Fifteen minutes in, a Binance Bitcoin wallet sent 18,270 bitcoin, about $1.47 billion, which the attacker instantly began chopping into round 1,000- and 100-bitcoin pieces to muddy the trail. Two minutes later, 612.7 million in Tether's dollar coin left Binance on the Tron network.

The biggest haul came on Ethereum. Think of an exchange's "hot wallet" as the cash drawer at the front counter: it is online so customer withdrawals can go out fast, unlike the vault kept offline. The attacker got Binance's Ethereum cash drawer to sign 50 pre-written permission slips handing control of the wallet to the attacker's own program. A wallet's permissions only work at the exact count of transactions it has reached, and Binance's count moves constantly, so the thief brought 50 slips to be sure one would match. One did.

Three minutes and 24 seconds later, a single transaction emptied the wallet: 167,464 ether plus 63 other tokens, including 1.615 billion in Tether's dollar coin. Because the permission stayed in place, the attacker kept coming back to sweep up new deposits for more than three hours.

Not one laptop: "additional points of breach"

Binance's first explanation pointed to one compromised laptop. Co-CEO Richard Teng posted overnight that the break-in "may have started with a compromised DevOps engineer's laptop," which gave the attacker access to a system that could submit withdrawals. He added: "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action."

About an hour later the company went further. "Our subsequent investigation has uncovered additional points of breach," Binance said, calling it "a complex attack."

TRM's own read backs that up. It says the Ethereum trick alone could look like phishing, but Binance wallets on nine other networks sent money out through ordinary signed transfers at the same time. In TRM's assessment, that "points to a compromise of Binance's hot wallet signing infrastructure," the machinery that approves the exchange's withdrawals. Binance says it has found no evidence that any wallet's private key leaked and has promised a full technical post-mortem.

The race to freeze it

Once the money left, it became a footrace. Bitcoin and ether cannot be frozen by anyone. Dollar-backed "stablecoins" can, by the companies that issue them. Chainalysis says the thief tried to outrun the freezes by swapping $325 million in stablecoins into $285 million of ether in about 20 minutes, but issuers started freezing within an hour of the first theft.

TRM lists who stepped in: Tether, Circle, Ripple and World Liberty Financial, the Trump family-backed company behind the USD1 stablecoin, froze about $2.67 billion in stablecoins, and Arbitrum's security council froze funds on its network, for roughly $2.7 billion in all. Binance's latest count is about $3 billion frozen.

That still leaves a mountain of money out of reach. TRM says the attacker holds more than 420,000 ether and 18,270 bitcoin, about $2.4 billion that no issuer can touch.

Why the North Korea fingerprints matter

The strongest clue came overnight. Blockchain investigator ZachXBT reported that money stolen from Binance had been mixed at the same address as funds from last month's $388 million theft from the Bitget exchange, which had been tied to North Korea. Chainalysis says it watched the same commingling "in real time" and called it the "direct on-chain link" that firmed up its verdict.

TRM points to other matching habits: tiny Tornado Cash withdrawals to fund the operator, staging that began well before the theft, and signatures gathered ahead of time and fired off in one burst, the same pattern it saw in the Bybit job and an April 2026 hack of KelpDAO.

This is not just a crypto story. In a January 2025 joint statement, the United States, Japan and South Korea said they work to recover North Korea's crypto thefts "with the ultimate goal of denying the DPRK illicit revenue for its unlawful weapons of mass destruction and ballistic missile programs." If the attribution holds, Kim Jong Un's regime just pulled off one of the largest financial crimes ever, and money like this is exactly what those three governments say pays for his weapons programs.

The U.S. government had not publicly named a culprit as of Friday morning. After Bybit, the FBI took five days: the theft happened on or about Feb. 21, 2025, and the bureau's Feb. 26 notice named North Korea and published the thieves' wallet addresses so exchanges could block them. Binance says it is working with law enforcement.

Who eats the loss

Binance says its customers won't. The company says it has set aside more than $6.34 billion of its own money to cover the theft, and that $5 billion of it is already held in the exact tokens that were taken. It is buying the rest on the market. "We will weather this storm," the exchange posted Friday.

Founder Changpeng Zhao laid out the math more bluntly: about $3 billion frozen, more than $1 billion in Binance's emergency fund for users, leaving a gap of about $2 billion. Binance's SpaceX stock, which he said came from its $500 million investment in Elon Musk's Twitter takeover, is "worth more than a billion" on its own. "Remaining gap is (still painful, but) manageable," he wrote.

Deposits are working. Withdrawals stay paused while Binance rebuilds its withdrawal system; the company said early Friday it was on track to restore them within about 45 hours. It has also promised an updated public accounting of its reserves once the cleanup is done.

What to watch

Three things decide how this ends: whether the FBI formally names North Korea and flags the wallets as it did after Bybit, how much of the $2.4 billion in unfreezable coins the trackers can catch before it is cashed out, and what Binance's post-mortem says about how a thief got the keys to its front counter.