Binance's $6.3bn Hack: The Biggest Theft in History, Blamed on North Korea

Binance, the world's largest cryptocurrency exchange, has lost $6.3bn in a hack that analysts call the largest theft of any kind in history. Elliptic, a consultancy specialising in crypto-related crime, says the haul is more than four times bigger than the previous record crypto hack — the $1.5bn attack on the Bybit exchange last year.

"This incident is almost certainly the single largest known theft of any kind," says Tom Robinson, Elliptic's chief scientist. "Before Bybit, that record was held by Saddam Hussein, who took $1bn from the Central Bank of Iraq in Baghdad on the eve of the 2003 Iraq War. The Binance theft is more than six times larger."

How did the attackers get in?

They didn't crack any cryptographic keys. According to Binance, the breach started with a compromised engineer's laptop, along with other points of breach, which gave the attackers access to the exchange's internal systems. From there, they made Binance's own systems sign transactions sending funds to the attackers.

"Hackers rarely crack the cryptographic keys themselves," Robinson says. "They instead target people with access to those wallets."

The scale was brutal in its simplicity. More than $2.5bn of the $6.3bn was moved in a single transaction. The attackers drained Binance's "hot" wallets — the internet-connected pots used for quick withdrawals — rather than the offline "cold" storage that holds most customer assets.

Who is behind it?

The attack has been attributed to TraderTraitor, a North Korean hacking unit named by the US government. The group emerged from Lazarus, which operates out of North Korea's Reconnaissance General Bureau, a military intelligence agency. TraderTraitor was blamed for last year's $1.5bn theft from Dubai-based Bybit.

Elliptic and two other crypto analysis firms attribute the Binance attack to North Korea. Elliptic says some of the stolen funds have already been traced to wallet addresses used in a crypto exchange hack last month, also thought to be the work of the rogue state's operatives.

Rafe Pilling, senior director of threat intelligence at Sophos, notes North Korea previously hacked conventional targets such as the Bangladesh Central Bank and even cash machines. Crypto simply pays better.

"Crypto is less well regulated, easier to move, easier to launder and that makes it a more enticing target for North Korea," Pilling says. "And as a result you have groups like TraderTraitor that are specialising in attacking crypto firms and getting away with huge payments."

Why the target is so attractive

The stakes explain the attention. Coingecko, a market monitor, counts more than 22,000 cryptocurrencies, with the entire market worth roughly $2.7tn. Binance alone handles around $95bn in trades daily, making it the largest exchange by volume. A corner of global finance that holds that much money, runs largely unregulated, and remains vulnerable to digital thieves is a natural hunting ground.

Cryptocurrency itself operates online, outside the traditional financial system. Bitcoin and peers such as Ethereum, Ripple and Dogecoin have no physical form. Owners hold a private key — effectively a long password — to access funds, with every transaction recorded on a public ledger known as a blockchain. Exchanges typically host customers' wallets, splitting holdings between safer offline "cold" storage and internet-linked "hot" wallets.

What does this change for investors?

Here's the practical question: if your exchange gets robbed, who makes you whole? Not the state. Any guarantee comes from Binance itself, not from regulatory or government-backed safety nets. The exchange said in a post on X that it would "cover all losses" and that "user funds are safe". It also said it had frozen about half the funds targeted in the hack, blocking the thieves from moving that tranche.

The contrast with banking is stark. Customers of regulated banks get capped refunds — up to £120,000 per customer per bank in the UK and $250,000 in the US — but only if the lender goes out of business. Even then, a hack at a solvent bank triggers no payout. Crypto users in the US, UK and Australia have no formal deposit protection at all if an exchange is hacked or goes bankrupt.

One narrow exception: in Australia, you can claim a capital loss on your tax return if you can prove a crypto asset was lost or stolen. Most customers, though, will have no legal protections to fall back on.

"Crypto exchanges are safer than they used to be, but not immune to attacks such as this," Robinson says. "This hack shows that even the biggest exchange can be breached through one employee's laptop. What matters most for customers is whether the exchange can cover the loss. Binance says it will repay everyone from its own funds."

For practitioners, the takeaway is uncomfortable: your security now depends less on cryptography and more on an exchange's balance sheet and its supply-chain hygiene. Until regulators extend deposit-style protection to crypto, a company promise is the only backstop — and Binance has just become the largest test of whether that promise holds.