Binance's $6.3bn hack exposes crypto's dependence on the middlemen it was built to replace

Cryptocurrency exchange Binance announced on Thursday that approximately $6.3 billion worth of digital assets had been stolen in what appears to be the largest crypto heist ever recorded. The world's most prominent crypto exchange revealed that roughly half of the stolen assets had been frozen, but a significant portion remained under the control of the hackers.

Binance stated it would cover all losses incurred due to the incident. Initial investigations indicated that a compromised engineer's laptop allowed the attacker to make unauthorized withdrawals. However, subsequent inquiries revealed additional points of breach. The incident, which surpasses the previous record-breaking $1.5 billion heist on the Bybit exchange in 2025, has been traced to a North Korean hacking unit known as TraderTraitor, also referred to as the Lazarus Group in the cybersecurity community.

This group has been previously linked to the 2025 Bybit hack. Check Point, a cybersecurity firm, confirmed that the Lazarus Group is responsible for the Binance hack. The estimated losses inflicted by the Binance attack have been labeled as the most significant crypto theft on record. The attacker still holds a vast amount of stolen assets, making the process of tracing and recovering the funds a challenging task.

Ari Redbord, the global head of policy at AI-powered investigations company TRM Labs, stated that several aspects of the Binance attack mirror earlier North Korean-linked incidents, including the Bybit hack. Redbord characterized the Binance hack as a "watershed moment" that is unprecedented in the industry. Binance, founded in China in 2017, enables users to trade digital assets and boasts more than 300 million registered users globally.

As of 2024, the company held custody of more than $160 billion in assets. The exchange has faced regulatory scrutiny in various parts of the world. Chainalysis, a cryptocurrency analytics firm, expressed high confidence that the North Korean group is linked to the Binance hack. For the past few years, North Korea-linked operatives have primarily targeted cryptocurrency companies for large-scale thefts of digital tokens.

Western security agencies have previously alleged that the stolen funds are utilized to finance North Korea's nuclear weapons and missile development programs. North Korea has denied any involvement in past hacks. Binance did not provide a direct response to inquiries concerning the potential connection between the hack and North Korea.

However, the company emphasized its collaboration with law enforcement authorities to identify and prosecute those responsible. Binance.com, the primary Binance platform, was affected by the incident. In contrast, Binance.US, a smaller crypto platform catering to American residents, reported that its platform remained unaffected by the security breach.

Binance's co-CEO, Richard Teng, disclosed that the initial investigation suggested that the hack began with a compromised engineer's laptop, granting the attacker access to a service container where unauthorized withdrawal transactions were submitted. Teng clarified that the attacker did not simply exploit a single engineer's permissions, as the attack involved a more intricate process.

A comprehensive post-mortem report would be released upon the completion of the investigation. Binance subsequently updated its statement on X, revealing that additional breach points were discovered during a subsequent investigation. Check Point's chief information security officer, Jayant Dave, noted that the attack was similar to another hack on the Bitget exchange in September, resulting in a loss of $388 million.

Dave suggested that attackers no longer require the vault keys, as they target systems and individuals with the authority to use them. Binance's co-CEO, Yi He, expressed gratitude to various cryptocurrency issuers for freezing the stolen assets and announced the temporary disablement of withdrawals until the security situation was confirmed.

Two other prominent crypto platforms, Tether and Circle, also froze a combined total of approximately $2.4 billion in response to the potential Binance hack. World Liberty Financial, a crypto company associated with US President Donald Trump and his family, stated that they had worked with their partners to freeze the stolen funds.

The price of major cryptocurrencies such as Bitcoin, Ethereum, and Solana declined sharply following the alerts about the Binance hack.