Binance, the world's largest cryptocurrency exchange, has suffered a $6.3bn heist that experts believe is the biggest theft in history. According to Elliptic, a consultancy specialising in crypto-related crime, the incident is more than four times larger than the previous record for a crypto hack, the $1.5bn theft from the Bybit exchange last year. Tom Robinson, Elliptic's chief scientist, said the Binance theft is more than six times larger than the previous largest known theft of any kind, which was $1bn taken by Saddam Hussein from Iraq's central bank in 2003. More than $2.5bn of the total was withdrawn in a single transaction.
The attack took place late on Thursday and is attributed to TraderTraitor, a North Korean hacking unit identified by the US government. The group emerged from Lazarus, which operates under North Korea's Reconnaissance General Bureau, a military intelligence agency. Elliptic and two other crypto analysis firms linked the attack to North Korea, noting that some of the stolen funds have already been traced to wallet addresses used in a cryptocurrency exchange hack last month also believed to have been carried out by North Korean operatives. According to Chainalysis, another crypto research firm, the attackers used laundering patterns never seen before to move the stolen assets.
Rather than cracking encryption keys directly, the hackers infiltrated a Binance engineer's laptop, gaining access to the exchange's internal systems. Binance later confirmed there were additional breach points in its security systems. Robinson explained that attackers typically target people with access to crypto wallets rather than the cryptographic keys themselves. From there, they made Binance's systems sign transactions that sent funds to their addresses. Binance operates the world's largest cryptocurrency exchange by daily trading volume, at about $95bn per day.
Binance said it will repay all losses from its own funds and has frozen about half the targeted cryptocurrency, preventing the thieves from accessing that portion. However, customers have no formal regulatory or government-backed safety nets. In the UK, regulated bank customers are guaranteed capped refunds up to £120,000 per customer per bank if their lender goes out of business, but this protection does not apply to crypto exchanges or cover losses from hacks. Similar protections do not exist in the US or Australia for cryptocurrency users. In Australia, customers can only claim a capital loss on their tax return if they provide proof the asset was stolen.
Rafe Pilling, senior director of threat intelligence at cybersecurity firm Sophos, said North Korea had previously targeted conventional financial institutions including the Bangladesh Central Bank and cash machines, but crypto offers bigger rewards. Crypto is less well regulated, easier to move and easier to launder, making it more attractive to state-sponsored hackers. Chainalysis estimates the thieves will need weeks, months or even years to convert the stolen cryptocurrency into legitimate fiat currency through less scrupulous exchanges, swapping services or brokers willing to convert crypto to cash.
For cryptocurrency investors and savers in the UK, this incident underscores that crypto exchanges offer no regulatory protection comparable to that provided to bank customers, and any compensation depends entirely on the exchange's own willingness and ability to cover losses.