Explained: How hackers stole $6.3 bn in crypto from Binance in just 20 mins

While Binance has said it will cover customer losses, the attack has drawn attention to vulnerabilities in the systems exchanges use to authorise and process transactions

Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack in which hackers stole approximately $6.3 billion worth of digital assets from wallets used to process transactions. The bulk of the theft reportedly took place in just 20 minutes.

 

The incident has emerged as one of the biggest security breaches in the history of cryptocurrency. While Binance has said that customer losses will be covered through its reserves and company resources, the attack has drawn attention to vulnerabilities in the systems exchanges use to authorise and process transactions.

 

Investigators have also pointed towards possible links with North Korean cybercriminal groups, although the identity of the attackers has not been officially established.

 

 

What happened in the Binance hack?

 

The attack targeted Binance's internal transaction authorisation system, rather than simply stealing cryptocurrency passwords or private keys.

 

According to blockchain analytics firm TRM Labs, cited by Reuters, hackers compromised Binance's signing infrastructure. This infrastructure is responsible for authorising transactions and allowing funds to move out of cryptocurrency wallets.

 

In simple terms, the attackers appear to have gained control over the system that approves withdrawals. This allowed them to issue unauthorised instructions to empty the affected wallets.

 

Binance initially suspected that a compromised laptop was involved. However, the exchange later said its investigation had uncovered additional points of breach, without providing further details.

 

A Binance Square post by crypto commentator Elizbeth Albury nCMB also described the incident as involving a compromised DevOps engineer's laptop, which allegedly gave attackers access to an internal service and enabled unauthorised withdrawal requests from a hot wallet. The post said Binance had found no evidence of private key leaks.

 

How did the hackers carry out the theft?

 

The attack unfolded rapidly, with the bulk of the stolen funds moved within approximately 20 minutes.

 

According to Reuters, blockchain records showed that the operation began shortly after 8 pm GMT on Thursday.

 

The sequence of events can be understood in three stages:

 

1. Compromising the system: The attackers gained access to Binance's transaction authorisation infrastructure, according to TRM Labs.

 

2. Unauthorised withdrawals: They used this access to issue instructions that transferred cryptocurrency out of the affected wallets.

 

3. Moving the stolen assets: After obtaining the funds, the attackers attempted to move them across different wallets and cryptocurrency networks to make recovery more difficult.

 

The attackers reportedly rapidly shifted the stolen assets to prevent Binance's counterparties and stablecoin issuers from freezing them.

 

Blockchain analytics firm Chainalysis also identified unusual laundering patterns. According to its assessment, thousands of transactions were executed within a short period, with funds repeatedly circulated between cryptocurrency addresses. This suggested that automated processes were being used to obscure the movement of the stolen assets.

 

Who is behind the Binance hack?

 

According to Reuters, several US-based blockchain analytics firms identified similarities between the Binance attack and previous cyber operations attributed to North Korean hacking groups.

 

TRM Labs said the breach shared characteristics with the 2025 attack on cryptocurrency exchange Bybit, which the FBI had attributed to North Korean hackers.

 

The firm expressed high confidence that the same group was responsible for the Binance theft.

 

Meanwhile, Chainalysis said funds stolen in an attack on cryptocurrency exchange Bitget in September were being mixed with proceeds from the Binance breach.

 

However, Binance co-CEO Richard Teng said the exchange's investigation had not yet identified the attackers.

 

Where has the stolen cryptocurrency gone?

 

Recovering the stolen funds remains a major challenge, although some of the assets have been frozen.

 

According to Reuters, approximately half of the stolen assets were stablecoins. These included USDT, issued by Tether, and USDC, issued by Circle.

 

Stablecoins are cryptocurrencies designed to maintain a relatively stable value, generally by being pegged to traditional currencies such as the US dollar.

 

Unlike Bitcoin and Ether, some stablecoins can be frozen remotely by their issuers. This gives companies such as Tether and Circle the ability to restrict the movement of stolen tokens.

 

Issuers including Tether, Circle, Ripple and World Liberty Financial had frozen roughly half of the stolen assets.

 

However, freezing cryptocurrency does not automatically mean that it will be returned to Binance.

 

The situation is more complicated for Bitcoin and Ether because neither has a central issuer with the authority to freeze individual holdings.

 

According to TRM Labs, approximately $2.4 billion worth of Bitcoin and Ether was beyond reach at the time of its assessment.

 

How will Binance compensate its customers?

 

Binance has said that customers will not have to bear the financial losses arising from the incident.

 

According to Reuters, the exchange operates a Secure Asset Fund for Users (SAFU), a $1 billion Bitcoin reserve designed to protect customers in the event of security breaches.

 

On Saturday, Binance said it has covered $6 billion of the $6.3 billion stolen from its platform.

 

A Binance Square post also reported that Binance had said deposits were operating normally and withdrawals were expected to resume gradually within 48 hours.