Binance, the world’s biggest cryptocurrency exchange, has suffered a theft of about $6.3 billion in what blockchain analysts describe as the largest cryptocurrency heist on record.

The bulk of the money was moved in around 20 minutes on Thursday, according to blockchain records. The attack has raised questions about how hackers gained access.

Also Read | What is Dahiya Doctrine? 5 key facts about Israel’s strategy of disproportionate force

The breach and how the heist unfolded

'They may have hijacked the system': the explanation from a crypto lawyer points to a breach deeper than a stolen password or private key | X (@pubity)
ZOOM IMAGE
‘They may have hijacked the system’: the explanation from a crypto lawyer points to a breach deeper than a stolen password or private key | X (@pubity)

The breach was not simply a case of hackers guessing a password and accessing an ordinary user account. TRM Labs said the attackers compromised Binance’s “signing infrastructure”, the system used to authorise transactions before a wallet releases funds.

That allowed them to issue instructions that emptied affected wallets. Binance initially suspected a compromised laptop, but later said its investigation had uncovered additional “points of breach”. It has not publicly detailed those entry points.

The affected wallets included an internet-connected “hot wallet”, which exchanges use to process transactions and move assets quickly.

The attackers appear to have interfered with the approval system behind the wallet. They may not have needed to steal the wallet’s private key itself.

Hong Kong-based crypto lawyer Joshua Chu explained the distinction to Reuters, “the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money.”

After the coins left Binance-controlled wallets, the attackers tried to move them beyond the reach of the exchange and other industry players.

Some stablecoins, including Tether’s USDT and Circle’s USDC, are issued by companies that can freeze tokens linked to suspicious activity. Bitcoin and ether do not have a central issuer with the same power.

Tether, Circle, Ripple and World Liberty Financial had frozen roughly half of the stolen assets. Tether said it froze nearly $1.57 billion, while Circle froze more than $800 million.

A freeze does not automatically return the money to Binance. It mainly stops the affected tokens from being moved freely.

The suspected North Korean connection

North Korea’s TraderTraitor group, tied to the $388M Bitget exploit, is likely also behind the $6.3B Binance hack, says ZachXBT. Stolen funds from both landed at one address | X (@Cointelegraph)
ZOOM IMAGE
North Korea’s TraderTraitor group, tied to the $388M Bitget exploit, is likely also behind the $6.3B Binance hack, says ZachXBT. Stolen funds from both landed at one address | X (@Cointelegraph)

TRM Labs attributed the theft to TraderTraitor, which it described as a North Korean hacking unit, saying it made the assessment with “high confidence”.

Chainalysis also said the attack was likely carried out by the same group.

The firms cited similarities with previous North Korea-linked thefts, including the 2025 Bybit hack. Binance, however, said it was working with law enforcement partners to identify those responsible.

North Korea has routinely denied involvement in cyberattacks.

Also Read | Serbia’s student-backed movement wins majority, but governing will test its mettle

Who picks up the hefty bill?

Customers have been told their funds are safe, but the Binance hack raises a bigger question: who absorbs a $6.3 billion crypto loss? | File Photo
ZOOM IMAGE
Customers have been told their funds are safe, but the Binance hack raises a bigger question: who absorbs a $6.3 billion crypto loss? | File Photo

The incident has also put the spotlight on crypto insurance. Exchanges and digital-asset custodians can buy specialised policies covering theft, cyberattacks, technology failures and legal claims.

But cover is not automatic or unlimited. Policies have limits, deductibles and exclusions.

Standard cyber insurance may pay for investigations, customer notifications and legal costs without covering the cryptocurrency itself, unless specific digital-asset protection is included.

Poor management of private keys can also affect whether an insurer pays a claim.

Binance has said it will cover the losses and that customer funds are safe. The company had set aside about $6.34 billion in company funds to cover the theft.

It also operates the Secure Asset Fund for Users, or SAFU, an emergency reserve worth roughly $1 billion in bitcoin as of 2026, according to Binance’s website.

Co-CEO Richard Teng said losses would be covered by the fund and company resources. Binance has not publicly confirmed the extent of its insurance coverage.

The recovery process remains separate from the question of who will ultimately bear the loss. The exchange says it will reimburse users, while investigators and industry partners continue trying to trace and freeze the stolen coins.