The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes
5 min read
Summary
Cryptocurrency firms and investigators are racing to freeze and track down billions of dollars of stolen digital cash following what appears to be the largest crypto heist of all time. On Thursday, starting at around 4pm ET, hackers started quickly siphoning around 6.3billionincryptocurrencies,spreadacrossmultipleblockchains,fromwalletsbelongingtocryptoexchange[Binance](https://www.wired.com/story/trumps−cz−pardon−has−the−crypto−world−bracing−for−impact/).Followingthetheft,Binancealmostimmediatelysuspendedalldepositsandwithdrawalsfromitsservicesaspartofitsinvestigationintothehackand[says](https://x.com/binance/status/2115993361517891592)itisworkingtoidentifywhowasbehindthebreach.Thecompany,alongwithothercryptofirms,saysithassofarbeenabletofreezearoundhalfofthestolenfunds—essentiallystoppinghackersmovingthemoneyfurtherortryingtocashitout.Muchoftheremainingcryptomaynotbepossibletofreeze,however.ThreecryptotracingfirmshavebeenquicktolinktheattackpotentiallytoNorthKoreanhackers.“WethinkNorthKoreaislikelyresponsible,”TomRobinson,chiefscientistandcofounderofElliptic,tellsWIRED.“IfNorthKoreaisbehindit,thisonetheftwouldalmostdoubleeverythingtheregimehasstolenincryptotodate.”Themajorityofthestolencryptowastakeninaperiodofaround20minutesonOctober29,accordingtoanalysisbycryptotracingfirmTRMLabs.WalletsbelongingtoBinanceacrossatleasttenblockchains—includingEthereum,Bitcoin,TronandSolana—weredrainedandsenttomultipleaddressescontrolledbyasingleattacker,accordingtoTRM’s[analysis](https://www.trmlabs.com/resources/blog/north−korea−steals−usd−6−36−billion−from−binance−in−the−largest−hack−in−history).“Preparationbeganatleast36hoursbeforethetheft,”TRMsaysinablogpost.Thecompanysaysoneoftheattacker’swalletsreceivedthreesmallwithdrawalsduringatestperiod,beforelaterexpandingtheoperations.“EarlyonOctober29,theoperatordeployedafirstpieceofcodefortheattackandtesteditontwowallets,”TRMsays.“Laterthatday,itrehearsedthefinalversiononathirdwallet,thenroutedthetestfundsbacktoitself.Fourhoursafterthatrehearsal,thesamecodewasinstalledonaBinancehotwallet.”Hotwalletsarecryptocurrencywalletsthatareinternetconnectedandallowcryptoexchangestohandlecustomerwithdrawals.Analystssaythefundsweredrainedfromhotwalletsacrosstheimpactedblockchains.NeitherBinanceorlawenforcementofficialshavenamedanysuspectedlinksbetweentheattackandNorthKoreanhackers,butresearcherssaythereareoverlapswithpreviouscryptocurrencyattacksfromTraderTraitor.Overrecentyears,NorthKoreanhackershaverepeatedlytargetedcryptocurrencyfirmsand[stolenhundredsofmillions](https://www.wired.com/story/north−korea−cryptocurrency−theft−ethereum/)incryptoheists.MultipleNorthKoreanhackinggroupscantargetcompaniesinthesectorbutTraderTraitorhavebecomespecialists,pullingoffinfrequentbuthighprofileattacks.ThetacticsusedinthehackappeartomimicpreviousmethodsusedbyanelitesubsetofNorthKoreanhackers,knownbythename[TraderTraitor](https://www.wired.com/story/tradertraitor−north−korea−crypto−theft/).CryptotracingfirmsTRMLabsandChainalysisbothsaytheybelieveTraderTraitormaybebehindtheattack,whileRobinsonsaysElliptichasn’tspecificallytiedittothegroupbutseesoverlapsintheactivity.WithinNorthKorea’s[sprawling](https://www.wired.com/story/north−korean−hacker−group−apt37/)[hacking](https://www.wired.com/story/ai−tools−are−helping−mediocre−north−korean−hackers−steal−millions/)[operations](https://www.wired.com/story/north−korea−hackers−indictment−cryptocurrency−sony−swift/)—oftendesignedtoearnmoneyforthehighlysanctionedandrepressiveregime—TraderTraitorhasstoodoutinrecentyearsforitssophisticationandtargetingofcryptoanddecentralizedfinancecompanies.Lastyear,theFBI[named](https://www.fbi.gov/investigate/cyber/alerts/2025/north−korea−responsible−for−1−5−billion−bybit−hack)TraderTraitorasbeingresponsibleforthe1.5 billion hack against crypto exchange Bybit.
Binance did not answer WIRED’s questions about whether it believes North Korean hackers are behind the colossal heist, pointing towards a statement saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach,” the company says in a statement. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”
“These folks in particular are somewhat artists in terms of getting into these distributed finance organizations,” Rafe Pilling, a senior director of threat intelligence at security company Sophos, tells WIRED. “TraderTraitor seems to focus on these larger operations. In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”
TRM and Chainalysis have initially linked the attack to TraderTraitor and say the determinations are based on their analysis of both on-chain and off-chain activity. “The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors,” a research blog from Chainalysis says.
“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says. “The attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, as in Bybit.”
While around 3billionofcryptocurrencywasinitiallyfrozenintheaftermathoftheattack,itislikelythosebehinditcouldstillpotentiallytakeawayhugesumsasnotallofthestolencryptocanbefrozen.ResearchfromChainalysissaysthecompanyisseeingmoney“launderingpatternswehavenotseenbefore”andthatthousandsoftransactionsbeingquicklyprocessedindicatesthattheyareusing“automationtoobscurethetrailoffunds.”Elliptic’sRobinsonsaysthataround2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins. “The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says. “It can only be stopped when it reaches an exchange or other service. Some will be caught over the coming months, but I don’t expect the frozen share to rise much further.”
Comments
Back to top
