Crypto's biggest-ever heist: How hackers stole $6.3 billion in Binance in just 20 minutes

Cryptocurrency exchange Binance on Friday reported a security breach with an estimated impact of $6.3 billion, in what could be the world's biggest heist in crypto history.

The attackers drained funds from wallets used by Binance to process transactions, with the bulk of the theft unfolding within around 20 minutes, according to blockchain records.

Also Read: Binance hack update: Will you lose your Bitcoin? Who stole the money, where has the stolen $6.3 billion gone, and how much has been recovered?


Here’s everything we know so far.

What happened in the Binance cyberattack?

Around $6.3 billion worth of cryptocurrencies were drained from wallets Binance uses to process transactions.

The exchange initially suspected that the attack involved a compromised laptop. However, its subsequent investigation uncovered additional points of breach, Binance said in a statement on X, without providing further details.

According to US-based blockchain analytics firm TRM Labs, the attackers compromised Binance's "signing infrastructure", which authorises transactions. This allowed them to issue instructions that emptied the affected wallets.

Also Read: Biggest crypto heist in history: How Binance’s $6 billion hack rattled markets and what it means for investors?

The bulk of the theft unfolded within approximately 20 minutes, beginning shortly after 2000 GMT on Thursday.

"In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," said Joshua Chu, a Hong Kong lawyer who works on cryptocurrency cases.

Binance operates a $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve designed to protect customers during security breaches. Co-CEO Richard Teng said the losses would be covered through the fund and company resources.

Who is behind the Binance hack?

The identity of the attackers has not been established. However, several blockchain analysis firms have said the breach bears similarities to previous cyber operations attributed to North Korean hackers.

TRM Labs said the attack shared characteristics with last year's breach of cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation (FBI) attributed to North Korean hackers. The firm said it was highly confident the same group was behind the Binance theft.

Meanwhile, Chainalysis said funds stolen in an attack on cryptocurrency exchange Bitget last month were being mixed with proceeds from the Binance breach.

Teng said Binance's investigation had not yet identified the attackers. North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts.

Where is the stolen money?

Around half of the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's cryptocurrency venture.

Stablecoins are cryptocurrencies designed to maintain a relatively stable value, usually by being pegged to currencies such as the US dollar. Some issuers can freeze these tokens remotely.

However, freezing the assets does not necessarily mean they will be returned to Binance. It does limit the attackers' ability to transfer or convert them.

TRM Labs said some of the stolen funds had already been used as collateral to borrow ether. It estimated that around $2.4 billion worth of bitcoin and ether remained beyond the reach of issuers capable of freezing assets.

"No company issues bitcoin or ether and no company can freeze either one," said Patrick Tan, general counsel of blockchain intelligence firm ChainArgos.

"The bitcoin and ether can be stopped only if the attacker sends them to a crypto-asset exchange or broker that is able and willing to freeze them, or if law enforcement obtains the private keys."

Market participants said the attackers could attempt to mix the stolen coins with other assets or use lesser-known cryptocurrencies and exchanges to move the proceeds.

Bernardo Brites, CEO of stablecoin infrastructure company Trace Finance, said the chances of moving stolen funds through exchanges and payment providers decline as time passes.

"The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers — they essentially get blacklisted," he said.

What happens next?

The Binance breach adds to a series of major cryptocurrency thefts. Attackers stole around $2.9 billion worth of digital assets across nearly 150 incidents last year, according to TRM Labs.

The incident has also shaken confidence in the sector. Cryptocurrencies fell on Friday, while the total market value of stablecoins declined, suggesting investors were pulling money out of digital assets.

The focus now is on tracing the remaining stolen funds, preventing their movement and identifying those responsible for the attack.

(With inputs from agencies)