In just 20 minutes, hackers pulled off what cybersecurity experts are calling the largest cryptocurrency theft in history, draining approximately $6.3 billion from Binance, the world’s biggest cryptocurrency exchange. The unprecedented attack has triggered an international investigation involving the FBI, the United States Secret Service, and financial crime investigators across the globe.
Even more alarming, cybersecurity researchers believe the operation was carried out by hackers working for North Korea, raising the possibility that billions of dollars in stolen digital assets could help finance one of the world’s most heavily sanctioned regimes.
The October 29 attack exposed a vulnerability at the heart of the cryptocurrency industry: digital fortunes worth billions can be moved across international borders in minutes, and recovering them can be extraordinarily difficult.
Billions Vanished in Minutes
The attack began late Thursday, October 29, when hackers gained unauthorized access to systems responsible for approving cryptocurrency transactions on Binance.
According to blockchain intelligence firm TRM Labs, the attackers transferred approximately $6.36 billion from Binance-controlled wallets across multiple blockchain networks. Most of the theft unfolded in roughly 20 minutes.
To put that figure into perspective, the criminals moved an average of more than $300 million per minute during the main phase of the operation.
Investigators believe the attackers compromised transaction-signing infrastructure, allowing them to authorize transfers that bypassed normal security procedures.
Binance initially identified a compromised laptop belonging to an engineer as a possible entry point. However, the company’s subsequent investigation uncovered indications of additional security breaches.
The attackers also reportedly used malicious software designed to erase evidence of their activities, complicating efforts to reconstruct exactly how the intrusion occurred.
For a company entrusted with enormous amounts of customer wealth, the scale of the failure raises serious questions about whether its internal safeguards were sufficient.
North Korea Emerges as the Leading Suspect
Cybersecurity researchers at TRM Labs and Chainalysis have identified North Korean state-linked hackers as the likely perpetrators.
TRM Labs attributed the operation with high confidence to TraderTraitor, a hacking group previously associated with major cryptocurrency thefts.
The methods used in the Binance attack reportedly resemble those employed during the February 2025 breach of cryptocurrency exchange Bybit, when approximately $1.5 billion was stolen.
The FBI previously attributed that attack to North Korean hackers.
North Korea has spent years developing sophisticated cyber capabilities capable of targeting financial institutions, cryptocurrency platforms, and digital infrastructure.
American authorities have repeatedly warned that cryptocurrency theft provides the North Korean government with a valuable source of revenue outside the international banking system.
That money can potentially support weapons development, intelligence operations, and other activities restricted by international sanctions.
If investigators ultimately confirm North Korean responsibility for the Binance theft, the implications could extend far beyond the cryptocurrency industry.
A successful operation of this magnitude would demonstrate that state-sponsored hackers can exploit private financial infrastructure to obtain sums comparable to the annual budgets of some government agencies.
However, the FBI has not publicly confirmed who carried out the attack, and the attribution to North Korea remains an assessment by private cybersecurity researchers.
FBI and Secret Service Enter the Investigation
By Friday, October 30, the investigation had expanded to include two of America’s most prominent federal law enforcement agencies.
The FBI confirmed that it was coordinating with government and private-sector partners to assess the breach, determine its consequences, and identify appropriate investigative steps.
The United States Secret Service also became involved in efforts to trace and recover the stolen digital assets.
Although most Americans associate the Secret Service with presidential protection, the agency also investigates financial crimes, computer intrusions, and digital currency theft.
The international nature of cryptocurrency transactions makes the investigation especially challenging.
Stolen assets can be transferred between digital wallets, exchanged for different cryptocurrencies, and routed through services designed to conceal their origins.
Unlike conventional bank transfers, many blockchain transactions cannot simply be reversed once they have been confirmed.
That creates a race between investigators attempting to freeze stolen assets and criminals attempting to move them beyond the reach of cooperating companies.
Nearly Half the Stolen Assets Identified or Frozen
Despite the enormous scale of the theft, investigators and cryptocurrency companies have already made progress in restricting access to some of the stolen funds.
Binance reported that approximately $3 billion in affected assets had been located.
Stablecoin issuers and other cryptocurrency companies moved quickly to freeze assets linked to the attack.
Tether reported freezing approximately $1.57 billion, while Circle froze more than $800 million in digital assets associated with the incident.
Ripple and other industry participants also assisted with efforts to restrict stolen funds.
These actions demonstrate an important distinction within the cryptocurrency market.
Certain centrally issued digital tokens can be frozen by the companies controlling them. Bitcoin and ether generally cannot be frozen through the same mechanism.
As a result, investigators may be able to identify stolen cryptocurrency on public blockchains without possessing the technical authority to prevent criminals from transferring it.
Locating assets is not the same as recovering them, and billions of dollars remain subject to ongoing tracing and recovery efforts.
Binance Promises Customers Will Not Lose Their Money
Facing one of the most serious crises in its history, Binance has promised to cover losses using company resources.
The exchange said it had allocated approximately $6.34 billion to address the financial damage caused by the attack.
Binance also maintains a $1 billion emergency protection fund intended to help safeguard customer assets during security incidents.
Company executives have emphasized that customers will be made whole despite the breach.
Binance temporarily suspended withdrawal services while engineers investigated the attack and reviewed security controls.
The company also announced plans to provide updated information about its reserves and the assets supporting customer balances.
Those assurances are significant, but they do not eliminate the questions surrounding the attack.
Customers must now rely on the company’s ability to honor its commitments, restore normal operations, and demonstrate that its security systems can withstand future attacks.
The incident illustrates the difference between owning cryptocurrency directly and entrusting it to a centralized exchange.
When digital assets are held by a third party, customers depend heavily on that company’s cybersecurity practices, financial reserves, and operational integrity.
Cryptocurrency Markets React
News of the breach rattled cryptocurrency markets.
Bitcoin fell to approximately $76,368, its lowest level in six weeks, while ether declined to around $2,178, a two-month low.
Binance’s BNB token also experienced selling pressure.
Shares of publicly traded cryptocurrency-related companies, including Coinbase, Strategy, and Robinhood, declined as investors reassessed the risks associated with digital asset businesses.
The reaction underscores how a security failure at one major exchange can affect confidence throughout the broader cryptocurrency industry.
Binance is not a small or obscure trading platform. It serves hundreds of millions of registered users worldwide and plays a major role in global digital asset trading.
A breach involving an institution of that size can influence investor confidence far beyond the directly affected wallets.
A Record That Dwarfs Previous Cryptocurrency Thefts
The Binance theft has surpassed some of the most notorious attacks in cryptocurrency history.
In February 2025, hackers stole approximately $1.5 billion from Bybit.
In 2022, attackers targeted the Ronin Network, stealing digital assets valued at approximately $540 million.
That same year, the Wormhole platform suffered a breach involving roughly $320 million.
The 2021 Poly Network attack involved approximately $610 million, although most of those assets were eventually returned.
The Binance incident is extraordinary not merely because of the amount involved, but because of the speed with which the funds were transferred.
An estimated $6.3 billion moved out of the exchange in an operation that lasted only minutes.
The attack demonstrates how criminals who successfully compromise a critical authorization system can potentially bypass layers of security designed to protect enormous financial holdings.
The Larger Threat to American Financial Security
The possibility that North Korean hackers carried out this attack presents a national security concern.
For years, American intelligence and law enforcement agencies have warned that foreign governments use cybercrime to evade sanctions and obtain financial resources.
Cryptocurrency offers criminals several advantages over conventional financial theft.
Transactions can cross borders rapidly, digital assets can be divided among thousands of wallets, and stolen funds can be routed through multiple blockchain networks.
Although public blockchains create transaction records that investigators can analyze, identifying the individuals controlling those wallets and recovering the money can be far more difficult.
The Binance incident also raises broader questions about the concentration of digital wealth in private exchanges.
A single compromised employee device, internal authorization system, or privileged account can potentially expose assets worth billions.
Companies handling such enormous sums face an extraordinary responsibility to protect their infrastructure.
Security failures are no longer merely technical problems. They can become international financial emergencies.
The Questions Binance Must Answer
As investigators continue tracing the stolen assets, several critical questions remain unanswered.
How did attackers obtain the level of access necessary to authorize billions of dollars in transfers?
Why did existing safeguards fail to stop the transactions before the damage reached such an extraordinary scale?
How much of the stolen cryptocurrency can realistically be recovered?
And if North Korean involvement is confirmed, what additional measures can governments and cryptocurrency companies take to prevent digital asset theft from financing hostile foreign operations?
Binance has pledged to compensate affected customers and strengthen its security systems.
But the consequences of this breach will extend well beyond one exchange.
The cryptocurrency industry has spent years promoting digital assets as an alternative to traditional finance. That promise depends on the public believing their money can be stored and transferred securely.
The largest cryptocurrency theft ever recorded has delivered a devastating challenge to that confidence.
Billions of dollars were moved in minutes. Federal investigators are now pursuing the money across an international network of digital wallets and financial intermediaries.
Whether the stolen funds are ultimately recovered or disappear into the hands of sophisticated cybercriminals, the Binance breach will stand as a defining test of cryptocurrency security and the ability of governments to confront financial warfare in the digital age.
