Back
Automatically translated version. May contain inaccuracies compared to the original.
The founder and former CEO Changpeng Zhao said that the world's largest crypto exchange, Binance, was hacked on the night of 30 October. The perpetrators drained crypto wallets of assets worth about $6,3 billion. Analysts say this could be the largest crypto theft in the history of the industry. A concise look at how this multi‑billion‑dollar fraud happened and what North Korea has to do with it.
Very complex operation
According to TRM Labs, which analyzes cryptocurrency transactions, the attack occurred in the evening of 29 October. The money was withdrawn from Binance crypto wallets across ten blockchain networks – Ethereum, Bitcoin, Tron, Solana, and XRP Ledger – in just 20 minutes. Later, an additional wave of transactions was recorded on Avalanche and Polygon networks.
How this became possible was explained by Binance's leadership. One theory being considered is that the attackers gained access to a DevOps engineer's laptop (an IT professional who develops and operates software). The hackers then managed to reach the exchange's internal infrastructure, the so‑called service container, and conduct illicit withdrawal operations.
This is an initial but not definitive version. There is no final proof that the laptop was the entry point. Moreover, the situation later appeared more complicated. Binance CEO Changpeng Zhao said the incident did not involve a single simple action using an employee’s permissions. He said the attack was a more complex, multi‑stage process. Investigators also found additional entry points into the system.
The exchange has hot wallets—digital wallets connected to the Internet. They are used to promptly send crypto to users when withdrawals are requested. It was these wallets that became the source of the stolen funds.
In normal circumstances, a withdrawal undergoes internal checks and digital confirmations. But it seems the hackers managed to persuade the infrastructure to sign transfers that the exchange itself did not intend to approve. In other words, they didn’t steal a key to a vault, they learned to make the security system open it on their orders.
A lot of money
As noted, the stolen amount reaches $6,3 billion. For comparison: that amount is roughly equal to three Kyiv city budgets (about $2, 3 billion), or about one and a half fortunes of Ukraine’s richest man, Rinat Ahmetov (around $4,2 billion).
The largest amounts stolen were: Ethereum (about $3,79 billion), Bitcoin ($1,47 billion), Tether (USDT) and TRX on the Tron network ($628 million), XRP ($296 million), Solana ($96 million), and others.
But taking money out of Binance was one thing; using it was not so easy. Binance enlisted help from other firms—token issuers. Tether froze a significant amount of its funds totaling $1,77 billion, Circle blocked about $825 million in USDC, Arbitrum Security Council used its authority to move the stolen ETH and ARB to an inaccessible wallet for the attacker, and so on.
In plain terms, exchanges managed to freeze part of the stolen funds—about $3 billion. But the hackers aren’t fools and knew the exchange would react immediately, so they acted fast to swap one crypto for another, even at an unfavorable rate to them. More importantly, they aimed to quickly dispose of tokens that could be frozen.
As a result, by the morning of 30 October, the hackers controlled about $3,2 billion. The billions frozen by the exchange remain visible in the database (on the blockchain).
Who hacked Binance?
The first suspects are already being named—North Korea‑based hackers from the TraderTraitor group. The current attack bears a striking resemblance to previous operations by this group: wallets were topped up first, then tests of withdrawals were conducted and digital authorizations prepared.
TraderTraitor is linked to some of the biggest crypto heists in recent years; they have long been on security services’ radar. For example, the FBI accuses North Koreans of hacking the exchange Bybit in February 2025 year, when they looted $1,5 billion. The motives are clear: North Korea, under sanctions, can hardly profit from traditional financial markets, so it relies on cybercrime to obtain foreign currency.
According to the Associated Press, South Korea’s intelligence agency reported in December 2022 year about North Korean hackers stealing cryptocurrency and other virtual assets totaling about 1,1 billion dollars over the previous five years.
This has happened before
This is not Binance’s first hack—there have been other serious episodes in its history, all reminiscent of the current one. In May 2019 year, two years after Binance emerged, hackers obtained user API keys, 2FA codes, and other data, and then drained $40 million from the exchange. The criminals also did not act chaotically but prepared the operation carefully. The exchange said its security system only kicked in after the money had already been withdrawn. Binance halted all withdrawals and deposits for about a week, conducted a large security audit, and promised to fully cover the losses from its SAFU reserve.
In October 2022‑th the attack affected not the entire Binance.com trading platform but the related BNB infrastructure. The hackers managed to drain about 130 million before developers halted the network.
The crypto exchange Bybit was hacked in February 2025 and lost 1,5 billion dollars. That led to talk of the North Korean hacker group TraderTraitor. Like the current attack on Binance, the criminals used trusted infrastructure and the operation‑confirmation mechanism, rather than merely stealing a wallet password.
Compensation from reserves or out of pocket
“No signs of stolen private keys have been detected,” said the platform itself a few hours after the night‑time attack of 30 October this year. Management promised to reimburse clients for all losses from the SAFU reserve and from their own funds, with law enforcement, analysts, and industry partners involved. They will try to track the stolen assets and block them.
The market reacted to the incident with a short‑term drop in crypto prices. Users still trust the exchange’s promises to reimburse all losses. The developers of Binance itself are examining all critical vulnerabilities in the security architecture of the world’s largest crypto exchange, and law enforcement is figuring out how to find the North Korean hackers and seize the stolen assets.
Document: PDF proof of the original version of the news item "Вкрали суму, що дорівнює трьом річним бюджетам Києва: як хакери обчистили Binance на $6,3 млрд". It records the publication content at the moment of the first scan, the preservation date and the source: KP.UA.
