North Korean hackers reportedly stole $6.36 billion from Binance in about 20 minutes, but the world's largest cryptocurrency exchange is moving to ensure customers don't pay the price.
The Oct. 29 attack is the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit breach in February 2025. Blockchain intelligence firm TRM Labs attributed the incident with high confidence to TraderTraitor, a North Korean hacking unit also linked to the Bybit attack.
Binance initially suspended withdrawals across several blockchain networks while investigating the breach. By Sunday, however, the exchange had covered approximately 90% of the stolen assets and begun restoring withdrawals in phases.
A 20-minute attack on Binance's wallet infrastructure
According to TRM Labs, the attackers began preparing at least 36 hours before the Oct. 29 theft, testing malicious code and preparing transaction authorizations.
The main wave of withdrawals began at 20:05 UTC, with Binance wallets across multiple blockchains transferring funds to attacker-controlled addresses. Attackers moved most of the $6.36 billion within about 20 minutes. A second wave involving Avalanche and Polygon wallets followed around 23:05 UTC.
TRM's investigation identified approximately $3.79 billion in Ethereum-related assets, $1.47 billion in Bitcoin, and hundreds of millions of dollars in assets on Tron and the XRP Ledger.
The attackers apparently compromised Binance's withdrawal-signing infrastructure rather than simply stealing a private key. On Ethereum, they used pre-signed EIP-7702 authorizations to make a Binance hot wallet execute a malicious smart contract that transferred its funds.
Binance initially identified a compromised engineer's laptop and unauthorized access to a service container. However, co-CEO Richard Teng later said investigators had uncovered additional points of breach and described a more complex operation.
“North Korea’s cryptocurrency operations have evolved from repeated attacks against exchanges and digital-asset projects into an industrial-scale revenue model,” Justin Moore, Arctic Wolf's director of Adversary Operations, told eSecurity Planet. “Rather than relying on one type of exploit, these operators target developers, employees, signing systems and third-party infrastructure, looking for the point where trusted access can be converted into an authorized transfer.”
Binance freezes and replaces billions in stolen assets
The response involved cryptocurrency issuers, blockchain security teams and law enforcement agencies. Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stablecoins, while Arbitrum's Security Council froze additional ETH and ARB tokens.
Binance said on Friday that industry partners had helped freeze approximately $3 billion in stolen assets. By Saturday, it had allocated more than $6.34 billion in company funds to cover customer losses.
In an update on Saturday, Binance said it had replenished approximately 90% of the stolen assets. The remaining 10% could take longer because some cryptocurrencies were less liquid and harder to purchase in the required quantities.
The exchange also began restoring withdrawals in phases, initially reopening access to Ethereum-based assets and some BNB Smart Chain holdings before adding other networks, including Solana.
Security experts warn of compromised employee access
The incident raises questions about how exchanges protect the systems that authorize transactions, particularly when employees have access to infrastructure capable of moving billions of dollars.
Moore said the apparent compromise of withdrawal and signing processes across several blockchains represents a significant escalation in North Korea's cryptocurrency theft operations.
“The defining feature of the Binance incident is the apparent subversion of trusted withdrawal and signing processes across several blockchains,” he said. He recommended stronger isolation of privileged employee devices, independent approval for high-impact transactions, and separating signing infrastructure from everyday work environments.
Rand Davis, chief technology officer at SecurityScorecard, told eSecurityPlanet the incident demonstrates how attackers target employees and the systems behind security controls. SecurityScorecard's Breach Susceptibility Indicator (BSI) for Binance stood at 97. The company says organizations scoring 97 or higher are 39 times more likely to experience a breach than its population baseline. However, the indicator measures observed security issues and exposure, not whether an attack will occur.
Davis also warned that organizations depending on cryptocurrency exchanges and custodians should maintain continuous visibility into those relationships and prepare for situations in which a provider suspends withdrawals or other services.
What the Binance breach means for crypto users
Binance's decision to cover the losses means customers whose assets were affected should not bear the direct financial impact of the theft. However, the incident exposed another risk of keeping cryptocurrency on centralized exchanges: access to customer assets depends partly on the security of the platform's internal infrastructure.
Although Binance has restored withdrawals across several networks, its phased approach means some users may still experience delays while the exchange completes security checks. The company also needs to complete its investigation and publish an updated proof of reserves.
For businesses that hold digital assets or rely on exchanges for payments and liquidity, the incident makes contingency planning essential. A platform can remain financially capable of covering stolen funds while temporarily restricting access to customer holdings.
The more significant concern is that compromising trusted employee access and transaction approval systems can bypass protections that would otherwise make individual wallets difficult to breach. Binance's recovery may reassure customers about its ability to absorb the loss, but the incident leaves the wider cryptocurrency industry with a more difficult security problem to solve.
Additional reading: For more on North Korea's cryptocurrency theft operations, read how a $293 million KelpDAO hack exposed weaknesses in decentralized finance security and was linked by researchers to the Lazarus Group.