North Korean hackers at it again- Binance loses $6.3 billion

Binance, a crypto exchange and a rival of SBF and the world’s dominant crypto exchange became the victim of the largest heist in history. Binance estimated the loss at about $ 6.3 billion. Stable coins act as cash in the crypto market. Binance froze about $ 3 billion of affected assets.

Market analysts said that the heist has been linked to North Korea. The company said that they have already reserved $ 6.34 billion of funds to cover the incident. Elliptic, an analytics company, said that this is the largest theft of this kind in history. Binance said that the initial investigation suggested that the hackers had compromised an engineer’s laptop for withdrawing funds. It must be noted that North Korea offers near total protection to its hackers.

Around 8pm GST on Thursday, the hackers initially stole from crypto currency wallets controlled by Binance, roughly $ 300 million in crypto tokens and after 30 minutes the hackers stole another $ 6.3 billion making it the biggest robbery of all times. It is believed that it is the handwork of state sponsored hackers.

North Korea is the world’s crypto leader in hacking. (refer “Hackers of North Korea” The HANS India 31.12.2025). Analytics said that Binance hackers used money laundering techniques not tried before. Rafe Pilling at Sophos and other cyber security researchers said the attack had all the hallmarks of a group known as ‘TraderTraitor’, a North Korean state sponsored entity associated with several previous crypto thefts. a cybercrime group also known as the Lazarus Group, which stole the then-record $1.5bn from crypto exchange, Bybit in 2025.

Major organisations, including the FBI, have accused North Korea of being responsible for the cyber-attack. The FBI has linked ‘TraderTraitor’ to at least three crypto heists since 2023, including last year’s $1.5 billion theft from crypto exchange, which shows that cryptos are very attractive for hackers. In the last few years North Korean hackers have increasingly targeted crypto currency exchanges and loosely controlled financial institutions that are deemed as ‘soft targets.’

The funds stolen by hacking financial institutions and cryptocurrency exchanges are directly channeled into the development and testing of weapons of mass destruction and ICBMs. According to a UN report these malicious cyberattacks account for roughly 50 per cent of North Korea’s foreign currency income which helps to fund up to 40 per cent of its nuclear weapons programme. Shocked by the largest heist in the history of crypto exchanges, Binance customers withdrew $3.6bn of assets from the world’s biggest cryptocurrency exchange as it reopened on Sunday. Binance said on X: “Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. (sic)”.

The firm suspended all transactions following the incident, which impacted $ 6.3bn worth of digital assets.

The company said it covered around 95 per cent of the assets stolen in the breach but the remaining amount may take longer to source. Binance has repeatedly said it would cover all the losses linked to the attack. It said they had replaced customers’ assets using a combination of sources, including its corporate treasury as well as its futures insurance and emergency reserve funds.

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said.

There was an “initial spike” in withdrawals, which later declined and “are stabilizing as expected”, it added Sunday’s net withdrawals account for just over two per cent of the $171bn of assets under its management, said Binance, which has been founded in China and has hundreds of millions of registered users globally.

(The writer is a former DG DRI, DG, NCB, DG EIB and member of CBIC)

ABOUT THE AUTHOR

B V Kumar

[email protected]