Binance was allegedly hit by a roughly $6.3 billion cryptocurrency theft Thursday, a loss described as the largest crypto heist in history.
TRM Labs said the attackers emptied Binance-controlled wallets in about 20 minutes, spreading the funds across ten blockchain networks. The firm attributed the operation to TraderTraitor, a North Korean state-sponsored hacking unit. The scale and speed turned a breach at one exchange into a warning for the wider digital asset industry.
Binance’s preliminary review pointed to a possible compromise of a DevOps engineer’s laptop. That access may have allowed an intruder to reach a service container and issue unauthorized withdrawal requests. The exchange said its review had not found evidence that private wallet keys were accessed, but investigators identified other possible intrusion points.
Meanwhile, cybersecurity researchers warned that North Korean operators were increasingly using artificial intelligence to impersonate employees, build malicious software, and attack financial institutions and cryptocurrency companies.
The Theft Was Prepared Before the Transfers Began
TRM estimated that about $6.36 billion in cryptocurrency moved from Binance wallets across Bitcoin, Ethereum, Solana, Tron, and other blockchains. Investigators also found signs of preparation at least 36 hours before the theft, including test transactions meant to check the malicious code.
TraderTraitor had previously been linked to the $1.5 billion Bybit theft in February 2025. The FBI attributed that attack to North Korea. The Binance loss was roughly four times larger, putting it well above the earlier incident in scale.
Freezing the Assets Bought Binance Time
Binance said it and industry partners froze about $3 billion in affected assets, although billions remained beyond its immediate control. Tether and Circle were among the companies that helped block funds. The attackers tried to swap stolen stablecoins for other cryptocurrencies before issuers could intervene.
Binance pledged to cover customer losses through its Secure Asset Fund for Users and additional company resources. Deposits continued normally, but withdrawals were paused during the investigation. The exchange expected withdrawal service to return within 48 hours.
Why It Matters
This incident matters because it challenges a common assumption about digital assets: protecting private keys alone is enough to protect customer funds. The reported route ran through infrastructure used to approve transactions, so the lesson reaches beyond a single wallet. It concerns the systems, employees, and safeguards surrounding the wallets involved. Customers, exchanges, stablecoin issuers, and other firms that help trace or freeze assets all become part of the response. Cooperation can reduce damage, but recovery depends on speed and coordination.
It also fits a broader warning from cybersecurity researchers about North Korean operators using artificial intelligence to imitate employees, create malicious software, and target financial and cryptocurrency companies. That makes this more than a question about an exchange’s controls. It is a test of whether digital asset businesses can identify attacks that combine technical access with human deception.
The unanswered issues remain important. Investigators still need to clarify how far the compromised access reached, whether every possible entry point is closed, and how much of the cryptocurrency can be recovered. The separate Polymarket breach adds pressure, but no connection has been established. For users, that uncertainty matters even after trading resumes, because the full chain of events may still be under review.
Markets Felt the Impact, Too
The theft shook crypto markets. Bitcoin fell to a six-week low, while Ether reached a two-month low, Reuters reported.
Another breach hit Polymarket on Thursday. A compromised third-party provider prompted the prediction market to suspend international trading temporarily. Bitquery identified about $2.73 million in unauthorized withdrawals involving 737 accounts over roughly one hour. Polymarket said it fixed the vulnerability, referred the matter to law enforcement, and would reimburse affected users. Trading later resumed.
Investigators have not established a connection between the Binance theft and the Polymarket incident. For Binance, the immediate milestones were the continuing security review, customer protection, and the promised return of withdrawals.
Source: The Liberty Daily
