North Korean Hackers Drain $6.3 Billion From Binance in 20 Minutes
State-sponsored North Korean hackers stole $6.36 billion from Binance in less than half an hour, marking the largest cyber theft in cryptocurrency history. Binance stated that customer balances remain unaffected and that the exchange will cover the loss using corporate reserves and its emergency insurance fund.
How the attack unfolded inside Binance
Attackers gained an initial foothold through a compromised employee workstation before orchestrating complex unauthorized withdrawals.
The intrusion moved with blistering speed. In under 20 minutes, the attackers drained digital assets across 10 independent blockchains, including Bitcoin, Ethereum, Solana, XRP, and Tron. Ethereum accounted for the bulk of the damage, shedding approximately $3.79 billion. Security analysts point to automated smart contracts as the vehicle that allowed the hackers to pull funds continuously the moment liquidity entered target wallets.
Binance co-CEO Richard Teng confirmed via LinkedIn that the entry point was a single DevOps engineer's compromised machine. That machine allowed attackers into a backend service container where they issued unauthorized transaction commands.
Teng clarified that the breach required more than basic stolen credentials. It was not a single-click takeover, but an orchestrated assault involving multiple layers of privilege escalation. Intelligence firm TRM Labs attributed the operation to TraderTraitor, a specialized unit operating under North Korea's state-sponsored Lazarus Group.
Binance cyberattack: confirmed details and losses
| Spec | Detail |
|---|---|
| Total stolen amount | $6.36 billion |
| Attack duration | Under 20 minutes |
| Attributed threat actor | TraderTraitor (Lazarus Group) |
| Heaviest hit network | Ethereum ($3.79 billion) |
| Funds frozen by partners | Approximately $3 billion |
| Customer deposit impact | None (covered by SAFU) |
| Attack vector | Compromised DevOps laptop |
Billions frozen as issuers scramble
While $6.36 billion left Binance's operational reserves, the hackers will struggle to cash out the full haul. Centralized stablecoin issuers and decentralized emergency committees intervened almost immediately to blacklist illicit addresses.
Tether, Circle, Ripple, and World Liberty Financial successfully froze around $2.67 billion worth of assets. On the Arbitrum network, the governing Security Council halted 8,426 ETH and 74.6 million ARB tokens, locking down another major portion of the loot. In total, authorities and partners managed to freeze roughly $3 billion before the thieves could route it through mixers.
Binance temporarily suspended user deposits and withdrawals while incident response teams audited internal pipelines, sparking brief confusion among traders whose transactions were denied during the morning rush.
Lazarus repeatedly turns software engineers into initial access vectors using bogus job interviews and trojanized code repositories. A DevOps endpoint should never possess direct reach into withdrawal automation without strict multi-party cryptographic thresholds. Binance may absorb the $3 billion unrecoverable loss today, but the fact that an internal container yielded this much liquidity in 20 minutes reveals a profound architectural failure.
Why crypto markets barely flinched
A decade ago, a breach of this magnitude would have crippled the market. When Mt. Gox collapsed in 2013 after losing $450 million, Bitcoin dropped 35% in weeks. Even the $1.5 billion Bybit hack earlier this year knocked 7.5% off the market.
Following the Binance news, Bitcoin fell just 6.7%. The muted reaction stems largely from Binance's corporate backing. Teng confirmed customer deposits were not directly drained and guaranteed that company reserves alongside the Secure Asset Fund for Users (SAFU) will cover the entire deficit.
The incident highlights the growing risks of enterprise credential exposure, echoing warnings from institutions like Bank of America on AI agent credentials and infrastructure attacks where servers used by cybercriminals facilitate rapid-fire operations.
What it means for users
Retail accounts on Binance remain fully solvent, with customer balances backstopped by the exchange's SAFU reserve. Normal deposit and withdrawal queues are resuming as security audits clear individual blockchain corridors.
Security firms caution users to stay alert for follow-up social engineering scams. Fraudsters frequently impersonate Binance customer support during major outages, urging victims to transfer funds to 'secure backup wallets' or disclose two-factor codes.
Frequently asked questions
Were customer funds stolen in the Binance hack?
No. The attack drained Binance's operational balances rather than retail customer wallets. Binance confirmed that its SAFU insurance fund and company reserves will cover all lost assets entirely.
Who carried out the $6.3 billion Binance cyberattack?
Blockchain intelligence firm TRM Labs attributed the operation to TraderTraitor, an elite hacking unit embedded within North Korea's state-backed Lazarus Group.
How much of the stolen crypto was recovered or frozen?
Stablecoin issuers including Tether and Circle, alongside the Arbitrum Security Council, froze roughly $3 billion worth of assets shortly after the transactions occurred.
Sources
- Binance hit by 'largest crypto theft on record' as North Korean hackers steal $6.3bn in just 20 minutes | TechRadar. techradar.com, 2026. https://www.techradar.com/pro/security/binance-hit-by-largest-crypto-theft-on-record-as-north-korean-hackers-steal-usd6-3bn-in-just-20-minutes