Binance, the world's largest cryptocurrency exchange, says hackers stole $6.3 billion from its wallets late last week in what blockchain investigators are calling the largest crypto theft on record — and one that mirrors a pattern of social-engineering tactics researchers have warned about for years.
The theft unfolded over roughly 20 minutes, according to the blockchain analysis firm TRM Labs, which said attackers ordered Binance wallets to empty into accounts they controlled — a method resembling the $1.5 billion Bybit heist the FBI attributed to North Korea in 2025. Chainalysis reached a similar conclusion, and the British firm Elliptic called it "almost certainly the single largest known theft of any kind."
How the attackers got in
Binance co-chief executive Richard Teng described a "complex attack" involving a compromised employee laptop and malware designed to erase evidence, "making it more difficult for us to trace and investigate." The exchange halted customer withdrawals immediately and said company funds — including a $1 billion bitcoin reserve — would cover the losses in full. A separate newsroom's own reporting on the breach traced the opening move to a bogus LinkedIn recruiting pitch that delivered the malware, not stolen private keys as some early theories suggested — an account that sharpens the picture of how the thieves first got a foothold.
Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust.
Richard Teng, Binance co-CEO
Binance said it has since located and frozen about $3 billion of the stolen funds, with the remainder still unaccounted for. Stablecoin issuers Tether and Circle separately froze more than $2.3 billion in assets linked to the incident, and the FBI and U.S. Secret Service are both involved in the investigation.
North Korea routinely denies responsibility for such attacks, and its missions did not respond to requests for comment. But TRM's global policy head, Ari Redbord, said the scale fits a familiar pattern: "When North Korea steals at this scale, the money supports weapons proliferation."
Bitcoin fell to a six-week low of $76,368 in the aftermath before partially recovering, and Binance's own BNB token dropped nearly 7%. HashKey Group researcher Tim Sun said the breach "may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges."
TRM Labs says North Korea-linked hackers stole roughly $2.9 billion across nearly 150 attacks in the past year alone — a tally this single breach has now more than doubled. Binance says it expects to fully restore withdrawal services within 48 hours and plans to bring in outside security reviewers.
