Binance Hack: Record $6.3B Heist Blamed on North Korea

The Binance hack is now officially the biggest crypto theft ever recorded, and it happened in a matter of hours. Binance, the world's largest crypto exchange, said on Thursday that about six point three billion dollars in digital assets were impacted, according to the BBC. Roughly half has been frozen. The rest is still in the hands of the attackers.

If you have ever traded on an app and assumed the big platforms are locked down like vaults, this one is a wake-up call. Here is what happened, who is being blamed, and why it matters even if you never touched Binance.

How the Binance hack unfolded

Blockchain analytics firm Elliptic says the theft began around eight in the evening UTC on October twenty-ninth, when five Binance wallets on the XRP Ledger sent two hundred thirty-three million XRP to a single attacker address. Over the next half hour, hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche were drained too, according to Elliptic's analysis.

Elliptic puts the total at six point four three billion dollars at the time of the theft. That is more than four times the Bybit heist of twenty twenty-five, which was the previous record. The largest single haul came from Ethereum, where several billion dollars across a huge range of tokens were swept out.

Binance has suspended deposits and withdrawals while it checks that its systems are secure. Co-chief executive Yi He said safety comes first and that withdrawals stay disabled until the environment is confirmed to be safe. The company's American arm, Binance.US, said it was not affected, and rival exchange Coinbase said it was untouched.

A laptop, a container and a bigger problem

So how did it happen? Co-chief executive Richard Teng said the initial investigation suggested the attack started with a compromised engineer's laptop, which gave the attacker access to a service container where unauthorized withdrawals were submitted. He stressed that it was not a single one-click action and that no wallet private key leak has been found so far.

Later, Binance admitted that its investigation had uncovered additional points of breach, and said a full post-mortem will follow. Security firm Check Point told the BBC that attackers no longer need the vault keys, because they go after the systems and people with the authority to use them.

In plain terms, the math of crypto was not broken. The humans and the software around the wallets were. Elliptic also notes the attacker abused a newer Ethereum feature that lets a regular wallet hand control to a smart contract, which is a nerdy detail with a very expensive result.

Why investigators are pointing at North Korea

Several firms, including TRM Labs and Chainalysis, have tied the attack to TraderTraitor, a unit linked to the Lazarus Group. TRM said it made that call with high confidence. Elliptic found that some of the stolen funds reached the same address that received proceeds from a Bitget exploit in September, which also looks North Korea linked.

There are caveats. Elliptic points out that only a small amount has landed at that shared address so far, which could point to a common laundering network rather than the same hackers. It also notes that no government or law enforcement agency has confirmed who did it. Western security agencies have previously said North Korean hack proceeds help fund its weapons programs, while the regime has denied involvement in past cases.

The race to freeze the money

The one bright spot is speed. Tether and Circle froze billions in stablecoins within the hour, and other issuers piled in, including World Liberty Financial. Elliptic has verified more than two point eight billion dollars frozen on chain, nearly matching Binance's own estimate of about three billion.

The problem is everything that cannot be frozen. Bitcoin, XRP, Solana and Ether have no issuer who can lock a wallet. Elliptic estimates the attacker still controls over three billion dollars in such assets, split across dozens of addresses, and expects the funds to be laundered through bridges and mixers over weeks or months.

What it means for your wallet

Binance says it will cover all losses and has set aside more than six point three four billion dollars, with about five billion already held in matching tokens, according to Cointelegraph. The company says it is beginning to recover assets for users. Still, the news pushed Bitcoin down more than four percent, and other major coins fell with it.

For regular users, the takeaways are simple. Do not keep everything on one exchange, use hardware wallets for long-term holdings, and treat any message about a "recruiter coding test" or urgent support link with suspicion. Want more crypto coverage? Check our crypto page for the latest as Binance publishes its post-mortem.