How North Korea's Hackers Pulled Off the $6.3 Billion Binance Heist in 20 Minutes

Hackers stole a record $6.3 billion from Binance, the world's biggest crypto exchange, in a heist that unfolded in about 20 minutes late on Thursday, October 29 — and the FBI says a North Korean state-sponsored unit was responsible.

According to Binance's own published account, the attackers used a fake job interview and malware hidden in an advertisement to compromise the computers of two software engineers, then leveraged a third engineer's computer to access the wallet signing service for the exchange's hot wallets. The multi-stage operation had begun in June.

The Federal Bureau of Investigation said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible, and that law enforcement had observed its members converting the stolen assets into ether. Pyongyang has for years denied using state-linked cyber units. President Donald Trump said on Saturday it remained unclear whether North Korea was involved.

Binance covered 95% of the stolen tokens using company money — about $6 billion bought as replacement tokens — from its $1 billion Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. About $3 billion of stolen assets had been located as of Friday. Tether froze roughly $1.57 billion and Circle about $800 million linked to the theft.

The exchange resumed withdrawals in phases from Sunday, November 1, starting with 15 cryptoassets including bitcoin, ether, XRP and dogecoin. Customers pulled $3.64 billion — 2.1% of assets — as the exchange came back online, but Binance said withdrawals were stabilizing and deposit volumes remained "substantial." Independent data from DefiLlama showed higher outflows of $5.81 billion.

Bitcoin fell to a six-week low on Friday after the heist and recovered above $78,000 by Monday. Analysts say the theft may be the biggest financial robbery ever. According to TRM Labs, attackers stole $2.9 billion across nearly 150 crypto incidents last year — less than half of what was taken from Binance in 20 minutes.

Binance has 335 million registered users and $171 billion in total assets under management as of October 28. The heist has already triggered a wave of consequences: the departure of its chief financial officer, tougher questions from insurers, and a fresh debate about whether any exchange can safely hold that much money in hot wallets.

Sources

• Reuters — Binance sees outflows stabilising, exchange returns online after $6.3 billion heist
• Reuters — Binance resumes bitcoin withdrawals after covering bulk of stolen $6.3 billion