Binance Heist: Researchers Point to North Korea in $6 Billion Crypto Theft

Hackers pulled more than $6 billion in cryptocurrency out of Binance in a late-afternoon raid that took about 20 minutes to complete, according to researchers interviewed by NPR. Binance is the world's largest crypto exchange, and the accounts hit included those of investment funds and individual traders who buy and sell currencies such as Bitcoin.

Security researchers are still working out the exact method, but the attackers moved through the exchange's security systems to reach customer trading accounts. Ari Redbord, global head of policy at the crypto research firm TRM Labs, said the theft exceeded any physical bank robbery. "Imagine a world where someone could walk into a bank and walk out with $6.36 billion in stolen funds and then move those funds at the speed of the internet," Redbord said.

TRM Labs and other researchers traced the operation to North Korea. Redbord cited the country's record of cyberattacks and said its military fields trained hacking teams. "North Korea has built the most sophisticated cyber capabilities in the world," he said, adding that stolen funds are used for weapons proliferation and other destabilizing activity.

Binance has pledged to cover customer losses and is working with other exchanges to freeze assets. About $3 billion that may have been taken from Binance customers has been frozen. Researchers can trace cryptocurrency movements the way serial numbers identify dollar bills, which lets them follow stolen funds as hackers attempt to move them into their own accounts. Not all of the money can be recovered.

Binance has faced regulatory trouble before. In 2023 the company pleaded guilty to violating anti-money laundering laws and paid more than $4 billion in penalties. Crypto exchanges are not regulated the way the New York Stock Exchange is, and account holders at Binance have not been publicly identified.

The theft occurred late in the afternoon and the bulk of the $6 billion was taken within about 20 minutes, according to researchers. Binance and those researchers are continuing to investigate how the security systems were bypassed.