North Korean Hackers Take $6.3 Billion From Binance in 20 Minutes
North Korean hackers took at least $6.3 billion from Binance within 20 minutes on a Thursday afternoon, in what Binance called a security incident. The sum is more than four times the $1.5 billion that North Korea-linked hackers stole from the exchange Bybit in 2025, which had been the previous record for a cyber heist. Binance is the world's largest cryptocurrency exchange, so the attack reached the biggest pool of customer-linked assets in the sector.
The attack was carried out by North Korea's TraderTraitor hacking unit, according to Forbes. Blockchain analytics firm TRM said the attackers were able to order Binance wallets to empty into wallets they controlled. A wallet, in this context, is an address that holds coins, and the party that can sign instructions for it can move the coins out. The thieves did not need to break the cryptography of any public blockchain. They needed to issue instructions that the exchange's own systems would execute.
Binance said it has covered $6 billion of the $6.3 billion stolen from its platform, according to Reuters. That is a replenishment of customer balances from the exchange's own resources, not a recovery of the stolen coins. Separately, France 24 reported that issuers froze roughly half of the stolen amount. Stablecoin issuers, the companies behind tokens pegged to the dollar, can freeze those tokens at the contract level, somewhat like a bank placing a hold on a check. The freeze figure matters because it is the only part of the loss that can be clawed back on-chain, and how much of it is recoverable depends on how quickly the funds moved and where they landed.
In my view, the gap between the two figures is the number to watch. Covering $6 billion protects customers in the near term, but it also turns a hack into a balance sheet question for the exchange. Whether the frozen assets come back, and on what terms, will determine how much of the $6.3 billion becomes a permanent cost to Binance.
Changpeng Zhao, Binance's founder, responded on X. He wrote that "No crypto wallet is 100% safe," and in a separate post, "No tech is 100% secure."
Those remarks are blunt, and I think they are accurate as far as they go. For a customer holding assets on an exchange, they are a reminder that a custodial balance is a claim on the operator's systems, and those systems can be compromised regardless of how the assets are stored on-chain.
The broader lesson for risk managers is about concentration. A single operator, a single set of signing and withdrawal controls, and a single attack surface sit behind a very large share of customer balances in the market. Exchanges have long emphasized segregation of customer funds, cold storage and monitoring. This episode suggests that a failure in the operational layer can move money faster than a monitoring team can respond, and that the cost lands on the platform's capital before it lands on the thieves.
For ordinary savers and traders, the practical questions are simpler. Binance's replenishment suggests the exchange is trying to make customers whole, but that is an operator covering losses, not a guarantee written into a contract. Anyone who relies on an exchange should read its custody terms closely and treat counterparty risk as a live variable.
The 2025 Bybit theft set the previous benchmark, and this event has surpassed it by a wide margin. Whether the next record is set by a state-linked unit or another actor will depend less on any one exchange's security budget than on how quickly the industry can limit what a single compromised instruction is able to empty.
