MercoPress. South Atlantic News Agency

Hackers steal US$6.3 billion in crypto from Binance in the sector’s biggest-ever heist

The Secret Service, the federal agency responsible for financial crimes, said it was “working around the clock” with the private sector “to identify, freeze, trace, and recover” the funds

Hackers stole about US$6.3 billion in cryptocurrency from Binance, the world’s largest digital asset exchange, in the biggest theft in the sector’s history, which the US Secret Service is investigating with other agencies. Blockchain analytics firms point to a hacking group linked to North Korea, though there has been no official attribution.

Most of the theft took place in about 20 minutes from 20:05 GMT on Thursday, from the wallets Binance uses to process transactions, according to TRM Labs. Its chief policy officer, Ari Redbord, told the BBC that such speed “is the product of long preparation”: the attackers had funded an operator wallet 36 hours earlier and prepared in advance the signatures to authorise the transfers. According to TRM, they compromised the platform’s “signing infrastructure”.

Binance co-chief executive Richard Teng said the attack “was not carried out by one person”. The initial investigation pointed to an engineer’s laptop, but “additional points of breach” were later uncovered. The attackers exploited an Ethereum network mechanism known as EIP-7702 to gain control of a wallet without passing through normal approval controls, and used a “self-destruct mechanism” to erase their traces, according to Teng, who said customer losses would be covered by the company’s protection fund, a US$1 billion bitcoin reserve, and its own resources. Binance says it has begun recovering some funds. Withdrawals remain suspended and the company expects to resume them within about 40 hours; it will publish a full proof-of-reserves report on Monday.

The Secret Service, the federal agency responsible for financial crimes, said it was “working around the clock” with the private sector “to identify, freeze, trace, and recover” the funds, in coordination with the US Attorney’s Office for the District of Columbia. The FBI said it was “aware of the incident”.

About half of the stolen assets were stablecoins that their issuers — Tether, Circle, Ripple and World Liberty Financial, the Trump family’s crypto venture — have frozen. TRM estimates that about US$2.4 billion in bitcoin and ether is beyond reach, as no company can block them.

TRM Labs and Chainalysis said they had “high confidence” that the culprit is TraderTraitor, also known as Lazarus, a North Korea-linked group the FBI blamed for the theft of about US$1.5 billion from the Bybit exchange in 2025, until now the sector’s largest. Chainalysis detected Binance funds commingling with those from another recent attack attributed to North Korean actors. Pyongyang routinely denies involvement in such thefts. Bitcoin fell about 4% after news of the attack.