On Thursday, October 29, a sophisticated attack on Binance, the largest cryptocurrency exchange globally, resulted in the theft of approximately $6.36 billion across ten separate blockchains. The attack, attributed to North Korea's state-backed hackers, occurred in just 20 minutes, beginning at 20:05 Universal Time. The hackers exploited a vulnerability in Binance's digital wallets, siphoning off funds before the company could acknowledge a "security incident" and freeze withdrawals.
According to blockchain-intelligence firms TRM Labs and Chainalysis, the attack was carried out by TraderTraitor, an elite unit linked to Pyongyang's notorious Lazarus Group. This group is also suspected of draining $1.5 billion from the exchange Bybit in February 2025. The scale of the Binance heist has raised concerns about the security of cryptocurrency exchanges and the ability of North Korean hackers to fund weapons proliferation and other destabilizing activities.
The Binance heist was notable for its precision and patience. TRM Labs found that the groundwork for the attack was laid at least 36 hours earlier, with an operator wallet receiving small, untraceable withdrawals from Tornado Cash, a mixing service that launders the origins of funds. The attackers then wrote and tested their malicious code before installing it on one of Binance's live hot wallets.
The technical centerpiece of the attack exploited a feature of Ethereum introduced in May 2025, allowing an ordinary wallet to hand control of its behavior to a smart contract by signing an authorization. The attacker submitted a single transaction carrying 50 such authorizations, each signed by the compromised Binance wallet, pointing it toward a "sweeper" contract that answered only to the thief.
The breach was not confined to Ethereum, with Binance wallets on other networks, including XRP Ledger, Bitcoin, Tron, Solana, and five others, producing valid signatures authorizing transfers to the attacker. This suggested that the attacker had seized control of Binance's signing infrastructure itself. Binance has not yet published a root cause, but conceded that an initial theory, a hacked engineer's laptop, had given way to "additional points of breach."
In the aftermath of the attack, stablecoin companies moved quickly to freeze some $2.7 billion of the stolen funds. However, the attacker had anticipated the freezes and converted some of the stablecoins into assets that cannot be touched, selling Tether to market makers for Ether and borrowing more Ether against it on the lending protocol Aave.
The incident has raised concerns about the security of cryptocurrency exchanges and the ability of North Korean hackers to exploit vulnerabilities. The investigation is ongoing, and Binance has warned that the $6.3 billion tally "may continue to increase." The heist has also highlighted the need for greater security measures to prevent such attacks in the future.
Key points
- North Korean hackers stole $6.36 billion from Binance in just 20 minutes.
- The attack was attributed to TraderTraitor, an elite unit linked to Pyongyang's notorious Lazarus Group.
- The heist has raised concerns about the security of cryptocurrency exchanges and the ability of North Korean hackers to fund weapons proliferation.
