Key Takeaways
- • Hackers stole about $6.3 billion from Binance, the world's largest cryptocurrency exchange, in a record digital asset theft, according to Reuters.
- • The bulk of the heist unfolded in roughly 20 minutes beginning shortly after 2000 GMT on Thursday, per blockchain records.
- • Attackers compromised Binance's signing infrastructure, which authorizes transactions, allowing them to issue instructions that emptied affected wallets, according to TRM Labs.
- • Stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial have frozen roughly half of the stolen assets, while about $2.4 billion in bitcoin and ether is beyond reach, per TRM Labs.
- • Several blockchain analysis firms link the attack to North Korean hackers, though Binance has not yet identified the attackers and North Korea routinely denies involvement.
Summary
Hackers stole approximately $6.3 billion in cryptocurrencies from wallets Binance uses to process transactions, according to the exchange and expert analysis of blockchain records reported by Reuters. Binance initially believed the attack involved a compromised laptop, but its subsequent investigation uncovered additional points of breach, the exchange said in a statement on X without elaborating. Binance operates a secure asset fund, a $1 billion bitcoin reserve designed to protect customers in a security breach. Co-CEO Richard Teng said losses would be covered by the fund and company resources.
According to US blockchain analytics firm TRM Labs, the attackers compromised Binance's signing infrastructure, which authorizes transactions, enabling them to issue instructions that emptied the affected wallets. Blockchain records show most of the theft occurred in about 20 minutes beginning shortly after 2000 GMT on Thursday. Reuters reported that the attack's mechanics reflect a broader feature of the market: a Hong Kong lawyer, Joshua Chu, noted that the attacker may not have stolen the vault key but hijacked the system that instructs the vault to release funds.
After moving the funds, the attackers sought to place them beyond the reach of Binance counterparties and stablecoin issuers. About half the stolen assets were stablecoins, including Tether's USDT and Circle's USDC, which have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. Freezing does not guarantee return of the coins to Binance, but it significantly limits the attackers' ability to convert them to cash. TRM Labs said some funds had already been posted as collateral to borrow ether and estimated about $2.4 billion in bitcoin and ether is beyond reach. Patrick Tan, general counsel of ChainArgos, noted that because no centralized entity issues bitcoin or ether, those assets can only be stopped if transferred to an exchange willing to freeze them or if law enforcement obtains the private keys.
Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers. TRM said the breach shared characteristics with last year's attack on Bybit, which the FBI attributed to North Korea, and said it was highly confident the same group was responsible. Chainalysis reported that funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach. Chainalysis also observed laundering patterns it had not previously seen, with thousands of transactions in a short period suggesting automation. Binance has not identified the attackers, and North Korea's mission in Geneva and embassy in China did not immediately respond to requests for comment.
The theft follows a series of major digital asset breaches. According to TRM Labs, attackers stole $2.9 billion of cryptocurrency across nearly 150 incidents last year. Cryptocurrencies fell on Friday and the total market value of stablecoins declined, suggesting investors were pulling money from digital assets.
According to US blockchain analytics firm TRM Labs, the attackers compromised Binance's signing infrastructure, which authorizes transactions, enabling them to issue instructions that emptied the affected wallets. Blockchain records show most of the theft occurred in about 20 minutes beginning shortly after 2000 GMT on Thursday. Reuters reported that the attack's mechanics reflect a broader feature of the market: a Hong Kong lawyer, Joshua Chu, noted that the attacker may not have stolen the vault key but hijacked the system that instructs the vault to release funds.
After moving the funds, the attackers sought to place them beyond the reach of Binance counterparties and stablecoin issuers. About half the stolen assets were stablecoins, including Tether's USDT and Circle's USDC, which have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. Freezing does not guarantee return of the coins to Binance, but it significantly limits the attackers' ability to convert them to cash. TRM Labs said some funds had already been posted as collateral to borrow ether and estimated about $2.4 billion in bitcoin and ether is beyond reach. Patrick Tan, general counsel of ChainArgos, noted that because no centralized entity issues bitcoin or ether, those assets can only be stopped if transferred to an exchange willing to freeze them or if law enforcement obtains the private keys.
Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers. TRM said the breach shared characteristics with last year's attack on Bybit, which the FBI attributed to North Korea, and said it was highly confident the same group was responsible. Chainalysis reported that funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach. Chainalysis also observed laundering patterns it had not previously seen, with thousands of transactions in a short period suggesting automation. Binance has not identified the attackers, and North Korea's mission in Geneva and embassy in China did not immediately respond to requests for comment.
The theft follows a series of major digital asset breaches. According to TRM Labs, attackers stole $2.9 billion of cryptocurrency across nearly 150 incidents last year. Cryptocurrencies fell on Friday and the total market value of stablecoins declined, suggesting investors were pulling money from digital assets.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.