The biggest cryptocurrency hack on record has raised fresh questions about the industry’s ability to protect digital assets and become part of mainstream financial infrastructure. Binance, the world’s largest crypto exchange, suspended withdrawals from its platform after a security breach affected an estimated $6.3 billion worth of funds. Crypto exchanges have long been lucrative targets for hackers because they control huge pools of digital assets that can be transferred around the world rapidly, typically with a measure of anonymity. A barrage of cyberattacks has exposed decentralization — once touted as one of crypto’s greatest strengths — as a vulnerability. In February 2025, a team of North Korean hackers stole $1.5 billion from the cryptocurrency exchange Bybit — a dark day for the industry and the largest crypto heist ever recorded. Now that number looks paltry. Binance set an unwanted record on Thursday, losing $6.3 billion to hackers in an eye-poping attack that highlighted the deep vulnerabilities in crypto’s financial infrastructure. For years, the industry has struggled to prevent thefts, and the risks are growing even more extreme as attackers use artificial intelligence and other advanced techniques to steal funds and quickly launder them, crypto analysts and security experts said.
The Binance attacker used “laundering patterns we have not seen before,” the crypto analytics firm Chainalysis wrote in a blog post on Friday, noting that thousands of transactions in a short period suggest the use of automation to obscure the trail of funds. The details of how Binance was breached are still coming into focus. Both Chainalysis and TRM Labs attributed the hack to North Korea, which has targeted crypto companies for years. Binance initially said the attacker appeared to have compromised a laptop belonging to one of its engineers—specifically a DevOps engineer permitting unauthorized access to a service container—before clarifying that further investigation had uncovered additional points of breach, while confirming that investigations found no evidence wallet private keys were leaked or compromised. On the technical front, forensic blockchain analysis revealed a sophisticated execution mechanism on Ethereum: because the hot wallet’s transaction count or nonce kept increasing continuously while processing live user traffic, the attacker could not know the exact live value when executing. To bypass this, they sprayed a batch of 50 pre-signed authorizations using Ethereum’s EIP-7702 account-delegation standard across consecutive nonce values, letting one matching authorization successfully force Binance’s busiest hot wallet (Binance 14) to run an attacker-controlled smart contract script. This malicious delegation enabled the automated sweeping of ether, stablecoins, and dozens of other tokens without requiring further standard approval checks, after which the stolen tokens were rapidly churned through decentralized liquidity pools like Uniswap. The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs. Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron, and Solana—were drained and sent to multiple addresses controlled by a single attacker. TRM noted in a blog post that preparation began at least 36 hours before the theft, with one of the attacker’s wallets receiving three small withdrawals during a test period before operations expanded. Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets, later rehearsing the final version on a third wallet before installing the code onto a Binance hot wallet. Hot wallets are internet-connected cryptocurrency wallets that allow crypto exchanges to handle customer withdrawals.
Three crypto tracing firms quickly linked the attack potentially to North Korean hackers, with industry experts noting that the theft would nearly double everything the regime has stolen in crypto to date. The tactics used in the hack mimic previous methods used by an elite subset of North Korean hackers known as TraderTraitor. TRM Labs and Chainalysis both believe TraderTraitor is behind the attack, while other researchers note that while exact group attribution can vary, activity patterns closely match. However, neither Binance nor global law enforcement agencies have issued a formal, official confirmation naming the perpetrators yet. Over recent years, North Korean hackers have repeatedly targeted cryptocurrency firms and stolen hundreds of millions in crypto heists, with TraderTraitor standing out for its sophistication. Last year, the FBI named TraderTraitor as being responsible for the $1.5 billion hack against Bybit.
Binance did not answer questions about whether it believes North Korean hackers are behind the colossal heist, pointing instead to a statement saying it will cover all losses from the hack and work with law enforcement. Security analysts observed that TraderTraitor specializes in targeting larger distributed finance organizations through complex methods. TRM and Chainalysis linked the attack to TraderTraitor based on on-chain and off-chain activity, noting that funds stolen from Binance were observed commingling with funds from a previous exploit attributed to North Korean actors. Security experts add that the attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, echoing past operations.
While around $3 billion of cryptocurrency was initially frozen in the aftermath of the attack through coordinated efforts between Binance, blockchain analysts, and major token issuers—including Tether freezing about $1.6 billion and Circle freezing over $800 million in USDC, alongside actions by Ripple and World Liberty Financial—it is likely those behind it could still take away huge sums. Binance has promised to make customers whole and set aside funds to cover the losses, though it processes billions in transactions daily. Of the total stolen, $3 billion has been frozen by other companies, including Circle and Tether. Industry analysts report that roughly 44 percent of the total amount stolen has been frozen, with almost all of it consisting of stablecoins. Investigators emphasize that the remaining billions are mostly Bitcoin, Ether, and XRP, which cannot be frozen by issuers and can only be intercepted if they reach an exchange or other service.
That means North Korea won’t have access to a large portion of those coins, and Binance said it was working on recovery, though hackers have already moved billions beyond direct reach. Those losses may be only the beginning as the crypto world reckons with fast-evolving hacking techniques and growing risks. Even as political figures have endorsed the industry and sought to bring it into the mainstream, some crypto firms still struggle with the basic work of keeping customer money safe. Experts warn that artificial intelligence is turbocharging the ability of hackers to find and exploit subtle flaws across the ecosystem, and while North Korea possesses the sophistication to pull off such operations pre-AI, AI tools are democratizing advanced hacking. Asked Friday whether the United States believed North Korea was responsible, President Trump demurred, stating they were looking into it while remarking on the inherent dangers of digital currencies. Security researchers emphasize that modern cyber risk is now defined by speed, automated multi-vector deployment, and workflow subversion, meaning enterprises must fundamentally revamp developer environment hygiene and implement automated, real-time anomaly detection rather than relying on perimeter controls alone.
Crypto has struggled with major thefts since its inception in 2008, when industry pioneers viewed digital coins as a renegade alternative to banks outside government supervision. That philosophy made crypto vulnerable from the beginning. While many investors keep funds in personal online wallets where lost passwords mean permanent loss, others rely on centralized exchanges like Binance. However, exchanges are not subject to the same strict regulatory systems governing traditional banks and have often lacked effective guardrails against crime. In February 2025, North Korean hackers tricked Bybit CEO Ben Zhou into authorizing a routine transaction, exploiting a free software product to extract $1.5 billion. At the time, a security firm called the losses completely preventable, and Bybit weathered the crisis by drawing on corporate reserves and borrowing funds.
The attack on Binance appears far more serious. Founded in 2017, Binance quickly became the largest company in the crypto industry, processing up to two-thirds of all digital currency transactions. As soon as the system was breached, founder Changpeng Zhao assured customers on X that they would not lose any money, writing, “It hurts, but we will survive”. Zhao has a turbulent regulatory history, including a guilty plea to money-laundering violations in 2023, a $4.3 billion fine, a four-month prison sentence, a subsequent presidential pardon, and business ties to the Trump family’s World Liberty Financial. News of the hack spread rapidly on social media as analysts tracked sudden blockchain withdrawals, though money often moves too quickly for companies to respond.
In a statement, the F.B.I. said it was aware of the incident and engaged with partners to evaluate potential impacts and coordinate investigative steps. Western intelligence officials have long warned that crypto theft is a primary way the North Korean regime evades international sanctions and funds its nuclear weapons program. The Binance hack represents an especially lucrative payday that will nearly double the sum of all known North Korean crypto thefts. Security experts observed that North Korean hackers know crypto exchange security is often terrible, concluding simply, “They’re good at exploiting that. This is their best day at the office yet.”
Source Intelligence Layer: 1 | 2 | 3 | 4
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
