How Hackers Drained $6.3 Billion From Binance in a 20-Minute Heist

Hackers stole $6.3 billion from Binance after breaching systems that authorize cryptocurrency transfers, with the bulk of the record digital asset theft carried out in about 20 minutes.

The attack on the world’s largest cryptocurrency exchange began shortly after 2000 GMT on Thursday, according to blockchain records.

The attackers drained money from wallets used to process transactions, prompting a race to stop them from moving it beyond reach.

How the Wallets Were Emptied

The breach centered on Binance’s “signing infrastructure,” according to U.S. blockchain analytics firm TRM Labs.

By compromising the systems that authorize transactions, the attackers could instruct the exchange’s wallets to release funds.

Binance initially suspected a compromised laptop. Its investigation later identified other points of entry, though the exchange has not disclosed what they were.

“In layman's terms, the attacker may not have stolen the vault key; they may have hijacked the system that tells the vault to release money,” Joshua Chu, a Hong Kong lawyer who works on cryptocurrency cases, told Reuters.

The full route into Binance’s systems remains unclear.

TRM’s findings identify the transaction authorization process as the means of emptying the affected wallets, while Binance has yet to detail the additional breaches.

Frozen Does Not Mean Recovered

After the transfers, the attackers sought to move the proceeds beyond the control of counterparties and token issuers.

Roughly half the stolen assets were stablecoins that issuers have since frozen.

Those involved include Tether, Circle, Ripple and World Liberty Financial, the Trump family’s cryptocurrency venture.

Freezing restricts the attackers’ ability to use those assets or turn them into cash. It does not mean Binance will get them back.

Other cryptocurrencies offer fewer options for intervention.

TRM estimated that about $2.4 billion in bitcoin and ether was beyond reach, and said some stolen funds had already been used as collateral to borrow ether.

“No company issues bitcoin or ether and no company can freeze either one,” said Patrick Tan, general counsel of Singapore-based blockchain intelligence firm ChainArgos.

Tan said stopping those assets would require an exchange or broker willing and able to freeze them, or law enforcement obtaining the private keys.

Market participants expect attempts to obscure the trail by mixing stolen funds with other assets or routing them through lesser-known cryptocurrencies and exchanges.

However, wider identification of the stolen coins could make moving them through payment providers increasingly difficult.

North Korean Links Under Examination

Several U.S. blockchain analysis firms identified similarities with operations previously attributed to North Korean hackers.

TRM said it was highly confident the group responsible for last year’s Bybit attack, which the FBI attributed to North Korea, also carried out the Binance theft.

Chainalysis said proceeds from last month’s Bitget attack were being mixed with funds stolen from Binance.

Binance co-CEO Richard Teng said the exchange had not identified the attackers. North Korea routinely denies involvement in cryptocurrency thefts and cyberattacks.

Covering the Losses

Teng said Binance would cover losses through company resources and its secure asset fund for users, a bitcoin reserve valued at $1 billion.

The theft alone exceeded the $2.9 billion stolen across nearly 150 cryptocurrency incidents last year, according to TRM.

Cryptocurrency prices fell on Friday, while a decline in the combined value of stablecoins suggested investors were withdrawing money from digital assets.