The largest crypto theft ever took about 20 minutes

At 20:05 UK time on Thursday 29th October, money began to leave Binance, the world's largest cryptocurrency exchange. Over the next 20 minutes or so, about $6.36bn in bitcoin, ether and other tokens was moved out of the exchange's wallets on ten different blockchains, according to TRM Labs, a firm that traces payments on blockchains.¹

Binance gave its own figure as about $6.3bn. Another tracing firm, Elliptic, called it "almost certainly the single largest known theft of any kind".² The previous record for a crypto theft, set at the exchange Bybit in February 2025, was about $1.5bn.³

How it was done

A cryptocurrency exchange keeps most of its customers' money offline, in "cold" storage, and a working float online in "hot" wallets, so that withdrawals can be paid automatically. On a blockchain, whoever can sign for a wallet can move its money, and there is no bank to reverse the payment.

Binance said its first findings suggested the attack began with a compromised laptop belonging to one of its engineers, which let the attacker submit unauthorised withdrawals.⁴ By Friday it said it had found "additional points of breach", and that there was no evidence any wallet's private key, the secret that controls it, had leaked.⁵

TRM's reconstruction shows how carefully it was prepared. The attacker's own wallet was funded through a mixer, a service that hides where money came from, at least 36 hours earlier. On Ethereum, the attacker had Binance's hot wallet sign 50 authorisations in advance that handed control of its funds to the attacker's code; once one was used, the wallet's whole balance left in about three and a half minutes.¹

Within an hour Tether and Circle, the companies that issue the two largest "stablecoins", digital tokens pegged to the dollar, began freezing the stolen tokens they control. By Friday about $2.7bn had been frozen. The rest, more than 420,000 ether and 18,270 bitcoin, worth about $2.4bn, cannot be frozen, because no company issues them.¹

×

The trail to North Korea

All three of the best-known tracing firms, TRM Labs, Chainalysis and Elliptic, attribute the theft to North Korea. TRM names the unit the FBI calls TraderTraitor and says: "We make this judgment with high confidence."¹ Chainalysis's evidence includes stolen Binance funds being mixed, as they moved, with money from a $387m theft at the exchange Bitget in September that had already been linked to North Korea.⁶ Elliptic attributes it to "DPRK-linked actors", using the initials of the Democratic People's Republic of Korea.⁷

Until Saturday no government had said so; Binance's co-chief executive, Richard Teng, had said: "Our investigation has not attributed responsibility to any individual."² Then, on Saturday 31st October, the FBI said that North Korea was responsible and named the same unit, TraderTraitor. It said North Korean actors were laundering the stolen money, mainly by converting it into ether, and that it expected it to be "further laundered" in stages; it published the addresses involved and asked exchanges to block them.⁸ North Korea routinely denies such thefts.⁹

The FBI blamed the same North Korean unit for the Bybit theft.³ North Korea has been stealing from crypto companies for years: in 2022 the FBI linked its Lazarus Group to the $620m theft from the Ronin Network, the system behind an online game.¹⁰ The money matters to a country under heavy sanctions. In the last report of the UN's panel on North Korean sanctions, in 2024, one member state said cyber activity earned North Korea about half its foreign currency, and another said 40% of its programmes for weapons of mass destruction were funded "by illicit cybermeans".¹¹ Eleven governments, including Britain's, said last year that North Korea aims to steal "billions of dollars for its unlawful weapons of mass destruction and ballistic missile programs".¹²

"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," said Ari Redbord of TRM Labs.¹³

Who pays

Binance has 335 million registered users.² On Friday its two chief executives said: "Binance will absorb the financial impact of these stolen funds, not our users," and that more than $6.34bn of company money had been set aside.¹⁴ "Your money is safe and we're covering every loss," Teng wrote. At first Binance did not say where the money would come from.²

Withdrawals were suspended on Thursday, and Binance's target for restarting them moved several times. Deposits continued. Bitcoin fell to a six-week low.¹³

On Saturday Binance said it had already replaced 90% of the stolen assets, by buying new tokens with its $1bn Secure Asset Fund for Users, part of its futures insurance fund and its own treasury.⁸ The remaining 10% are less widely traded tokens that will take longer to buy. It said it was on track to reopen withdrawals on Sunday 1st November.⁹

Where it stands

The stolen bitcoin and ether that were not frozen are now moving through the laundering routes North Korea has used before, and recovering frozen tokens is a legal process. "A technical freeze may happen quickly, while returning funds can take months or years," said Eric Jardine of Chainalysis.¹⁵ Binance has published a new snapshot of its reserves, so users can check that their assets are backed one for one.⁸ Whether customers leave once they can withdraw will be the first test of whether an exchange can lose $6bn in an evening and carry on as before.