Largest crypto heist in history targets Binance, linked to North Korea

Consensus Summary

The world’s largest cryptocurrency exchange, Binance, suffered a historic $6.3 billion heist, with up to $8.9 billion in digital assets targeted in what experts describe as the largest crypto hack ever. The attack, which unfolded in under 20 minutes, involved unauthorized withdrawals from multiple 'hot wallets,' including Bitcoin, Ethereum, and stablecoins like USDT and USDC. Both ABC and the Guardian confirm the scale of the theft, though ABC provides additional context, such as the $8.9 billion equivalent and the freezing of $4.2 billion in funds by issuers. The hackers exploited a compromised staff laptop, a method that mirrors previous cyberattacks attributed to North Korea’s TraderTraitor unit, which has been active since at least 2020 according to U.S. cybersecurity warnings.

This heist surpasses the next-largest crypto theft, a $1.5 billion attack by North Korea-linked Lazarus Group in February 2025, which targeted ByBit. Binance’s history of cybersecurity incidents includes a $40 million theft in 2018 and a $568 million breach in 2022, though neither the Guardian nor ABC suggests these earlier attacks were linked to the same group. The exchange has since implemented a $1 billion Bitcoin reserve fund to protect users, though this detail is only mentioned by ABC. Analysts, including Nicholas Turnbull of Crypto Consulting Australia, have drawn parallels between the Binance hack and the 2025 ByBit attack, both of which involved sophisticated methods and potential state-backed actors.

Binance’s response to the breach has been swift, with CEO Zhao Changpeng reassuring users that their funds remain safe and that the company will cover all losses. ABC reports that Binance has suspended deposits and withdrawals while conducting security checks, though the Guardian does not detail this operational response. The exchange is collaborating with law enforcement and blockchain intelligence firms like TRM Labs and Chainalysis to trace and recover frozen assets. TRM Labs and Chainalysis have both attributed the attack to North Korea’s TraderTraitor unit with high confidence, citing on-and off-chain intelligence. The stolen funds have been laundered through automated processes, complicating efforts to recover them, though roughly half of the stolen coins remain frozen.

While both sources agree on the core details—such as the scale of the heist, the involvement of North Korea, and Binance’s commitment to covering losses—ABC provides deeper technical and investigative insights. For instance, ABC highlights the role of AI in enabling the attack, citing recent cybersecurity vulnerabilities linked to frontier AI models. The Guardian, however, focuses more broadly on the implications for cryptocurrency investments and the track record of North Korean hacking groups. The discrepancy in figures, such as the $8.9 billion equivalent and the $3.4 billion estimated as unrecoverable, also reflects differing emphases in reporting. Despite these variations, both outlets emphasize the unprecedented nature of the attack and its potential to reshape perceptions of cybersecurity in the crypto sector.

As investigations continue, Binance remains under pressure to recover the remaining $3.4 billion in stolen funds, though the exact timeline for restitution is unclear. ABC notes that the exchange is working with issuers and law enforcement to trace the money, while the Guardian does not provide updates on recovery efforts. The unresolved question of whether AI played a direct role in the attack—suggested by ABC’s experts—could further complicate future cybersecurity strategies in the industry. With Binance’s reputation and financial stability at stake, the fallout from this heist may extend beyond the immediate losses, potentially influencing global regulations and investor confidence in cryptocurrency platforms.