In roughly twenty minutes, state-backed hackers drained the world’s largest crypto exchange, eclipsing the Bybit theft and setting a grim new record for digital crime.
The money was gone before most of the world had finished dinner.
Beginning at 20:05 Universal Time on Thursday, October 29, an attacker reached into the digital wallets of Binance, the largest cryptocurrency exchange on earth, and in about twenty minutes siphoned off roughly $6.36 billion across ten separate blockchains. By the time Binance acknowledged a “security incident” and froze withdrawals, the theft had already outrun the company’s defenses, its auditors, and the previous ceiling of what was thought possible.
It is now the largest crypto theft ever recorded. And according to the blockchain-intelligence firms racing to trace the funds, it is the work of North Korea.
TRM Labs, which tracked every transfer as it happened, attributed the attack “with high confidence” to TraderTraitor, an elite unit linked to Pyongyang’s notorious Lazarus Group. The analysis firm Chainalysis reached the same conclusion independently. If the attribution holds, it caps a brutal ascent: the same hackers the FBI blamed for draining $1.5 billion from the exchange Bybit in February 2025 have now stolen more than four times that amount in a single night.
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” said Ari Redbord, TRM’s global head of policy. “That makes this a global security issue, not just a crypto theft.”
Twenty minutes of precision
What distinguished the Binance heist was not brute force but patience. The groundwork, TRM found, had been laid at least 36 hours earlier. An operator wallet received three small, untraceable withdrawals from Tornado Cash, a mixing service that launders the origins of funds. The attackers then wrote their malicious code, tested it on two throwaway wallets, rehearsed the final version on a third, and only then installed it on one of Binance’s live hot wallets, the internet-connected accounts an exchange uses to process customer withdrawals.
The technical centerpiece exploited a feature of Ethereum itself. Under a protocol change introduced in May 2025, an ordinary wallet can hand control of its own behavior to a smart contract by signing an authorization. At 20:20 UTC, the attacker submitted a single transaction carrying 50 such authorizations, each signed by the compromised Binance wallet, each pointing it toward a “sweeper” contract that answered only to the thief. Three minutes and 24 seconds later, the wallet emptied itself: 167,464 units of Ether and 63 other tokens, including $1.6 billion in the stablecoin Tether, vanished into an address the attacker controlled.
Crucially, the breach was not confined to Ethereum. In the same half-hour window, Binance wallets on the XRP Ledger, Bitcoin, Tron, Solana, and five other networks each produced valid signatures authorizing transfers to the attacker. Those chains use different keys and different cryptographic schemes; that all of them obeyed at once pointed, in TRM’s assessment, to a deeper rot: the attacker had seized control of Binance’s signing infrastructure itself. Binance has not yet published a root cause, though it conceded on Friday that an initial theory, a hacked engineer’s laptop, had given way to “additional points of breach.”
The scramble to freeze
What followed was a frantic contest between the thieves and the issuers of the tokens they had stolen.
Stablecoin companies moved within the hour. Tether froze some 1.77 billion, circle roughly million, and Ripple and World Liberty Financial smaller sums, while Arbitrum’s emergency security council clawed back about 30 million more. In total, close to 2.7 billion was frozen on the chain, a sum Binance put at around $3 billion.
But the attacker had anticipated the freezes and raced them. Where stablecoins could be seized, the thieves converted them, at a punishing discount of more than 10 percent, into assets no issuer can touch, selling Tether to market makers for Ether and borrowing more Ether against it on the lending protocol Aave. The result: even after the freezes, the attacker still holds more than 420,000 Ether and 18,270 Bitcoin, roughly $2.4 billion, now being funneled through “peel chains” and consolidation wallets designed to shake off anyone following the trail.
A nervous market, an old vulnerability
The shock rippled outward. Bitcoin fell to a six-week low of about 76, 000 and Ether slid to a two-month trough near 2,180 before markets steadied. Shares in the rival exchange Coinbase, which said it was untouched, dropped nearly 5 percent.
Binance, co-founded by the Chinese-born Canadian billionaire Changpeng Zhao, pledged to cover every loss, drawing on company funds well beyond its $1 billion emergency reserve, and said it expected to resume withdrawals within 45 hours. It insisted user balances were “safe.”
Yet the episode has laid bare a structural weakness that no single company can patch. “Any assets held at a centralised exchange are only as safe as the exchange itself,” said Sean Foley, a crypto-markets expert at Macquarie University in Sydney, “and the larger the exchange’s holdings, the larger a target it becomes.”
For Pyongyang, that target has become a lifeline. South Korea’s intelligence service once estimated North Korean hackers had stolen $1.1 billion in virtual assets over five years. The regime now appears capable of surpassing that figure in a single evening, converting the open architecture of decentralized finance into hard currency for a sanctioned state and its nuclear ambitions.
The investigation is ongoing, and Binance has warned that the $6.3 billion tally “may continue to increase.” Whatever the final number, a threshold has already been crossed. The biggest bank robbery in history required no mask, no vault, and no getaway car, only a signature, obtained in advance, and twenty minutes.
