Hackers drained a massive sum from the cryptocurrency exchange Binance, in what is being called the largest crypto heist on record. The Guardian headlined it "North Korean group blamed for $6.3bn Binance hack in biggest ever crypto heist". CNBC headlined it "Biggest-ever crypto hack impacts $6.3 billion as Binance works to contain fallout".
Blockchain analytics firms examined how the attackers moved funds out of exchange wallets. France 24 (English) reported: "TRM said the attackers were able to order wallets that Binance uses to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation had attributed to Pyongyang."1 Separate analysis traced the mechanics of the theft to a specific wallet maneuver carried out shortly before the main breach. Decrypt reported: "Three minutes earlier, an address funded through Tornado Cash, a mixer that scrambles the trail of crypto payments, submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that lets an ordinary wallet run smart-contract code."2 Estimates of the total amount taken were not identical across reports. Decrypt reported: "Blockchain analytics firm Arkham put the haul at $6.01 billion, taken from Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday, it said in a tweet."2 CNBC headlined it "Binance's $6.3 billion hack: What we know and what comes next".
Investigators pointed to a North Korean state linked hacking unit as responsible for the operation. CNBC stated: "TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence."3 Commentary on the breach described it as part of a broader pattern of state backed financial crime. The Guardian said: "We may be witnessing the industrialisation of state-sponsored crime. If North Korean involvement is confirmed, this is not simply a criminal group exploiting a weakness within an exchange. It is a state-linked operation capable of extracting significant sums from global financial infrastructure in minutes."4
The incident drew scrutiny from financial regulators, who said they were monitoring the situation. "spokesperson for the FCA said: “4While Binance wasn’t registered with the FCA to provide crypto services in the UK, we’re aware of the reported incident and engaging with them to understand the impac", The Guardian said. The Guardian headlined it "UK financial watchdogs monitoring fallout from $6.3bn Binance heist, as ‘elite North Korean hackers’ blamed – business live".
The episode also raised questions about how losses at exchanges are handled, since funds held there are not covered the way traditional bank deposits are. NBC News noted: "Unlike traditional bank deposits, funds kept in accounts with companies like Binance are not automatically insured against losses, potentially leaving any refunds up to the discretion of individual exchanges."
Reaction from traders and other market participants followed as the story developed.
