$6.3 Billion. 20 Minutes. One Laptop.

Twenty minutes. That is all it took. Shortly after 8 p.m. London time on Thursday — 1:05 p.m. in Las Vegas — money began pouring out of Binance, the largest cryptocurrency exchange on the planet, across ten different blockchains at once. By the time the flow was stopped, roughly $6.3 billion was gone. It is four times the previous record for a crypto theft, and in the words of TRM Labs investigator Ari Redbord, it is “the largest bank heist in human history.”

TRM Labs, which tracked the money as it moved, counted about $6.36 billion leaving Binance wallets, most of it inside that first 20-minute burst. This was not improvised on the night. On Ethereum, the attackers had prepared the ground more than a day earlier: using a mechanism called EIP-7702 delegation, they turned one of Binance's own hot wallets into a sweeper working for them, armed with 50 pre-signed authorizations — and they ran rehearsals more than 36 hours before the main event, according to TRM.

One laptop

Binance's own account of the break-in starts small. An initial investigation, the company said, points to a compromised laptop belonging to one of its DevOps engineers. From that machine, the attackers reached an internal service container and used it to submit withdrawal transactions the company never authorized. Binance says it has found no evidence that wallet private keys were leaked — the vault's keys, in other words, were not copied. The door was opened from inside the building.

By Friday, the picture had widened. Binance said a follow-up investigation had found “additional points of breach,” and co-CEO Richard Teng stressed that the attacker “did not simply use one engineer's permissions” — this was not a “one-click” action. TRM's assessment is blunter: the exchange's signing infrastructure itself was compromised.

The race to freeze half of it

Bitcoin and ether, once moved, answer to nobody — no issuer can claw them back. But a large share of modern crypto is stablecoins: tokens issued by companies that can freeze them in place with a line of code. That quirk turned Thursday night into a race.

Tether froze about $1.57 billion of its USDT, CEO Paolo Ardoino confirmed. Circle froze more than $800 million of USDC, per CEO Jeremy Allaire — the two freezes that founder Changpeng Zhao cited at roughly $1.7 billion combined in the first hours. Ripple froze about $200 million, co-founder Yi He said. World Liberty Financial froze $27 million of its USD1 token, and the Arbitrum Security Council moved 74.56 million ARB — about $30 million — into a frozen wallet. Binance puts the verified frozen total at about $3 billion, and counting.

What could not be frozen is the problem that remains: roughly $2.4 billion in bitcoin and ether — more than 420,000 ETH and some 18,270 BTC, per TRM — for which no issuer exists to hit a stop button. The attackers have already put some of the loot to work: stolen tokens posted as collateral to borrow at least 20,000 ether through the lending protocol Aave, and about 325 million USDT sold at a discount of more than 10 percent to convert it into ether, TRM found.

The fingerprints point north

TRM Labs, Chainalysis and Elliptic, along with Pangolin Intelligence, converge on the same suspect: TraderTraitor, the elite hacking unit of North Korea's regime, linked to the Lazarus Group. TRM states its attribution with “high confidence,” based on on- and off-chain intelligence. Chainalysis co-founder and CEO Jonathan Levin said the attack was “likely TraderTraitor,” and independent investigator ZachXBT found the Binance loot being commingled at a single address with funds from an earlier Bitget exploit — itself attributed to the same unit.

The fingerprints matter because they have been seen before. The FBI blamed TraderTraitor for the February 2025 theft of $1.5 billion from the exchange Bybit — until Thursday, the largest crypto theft on record. Before Bybit, Elliptic notes, the largest theft of any kind was Saddam Hussein's $1 billion seizure from Iraq's central bank in 2003. This single haul is also more than double the $2.9 billion stolen across roughly 150 crypto attacks in all of last year, per TRM.

Two cautions belong in the record. No government has formally attributed this attack yet — in the Bybit case, the FBI's naming of TraderTraitor came five days after the theft — and Binance itself has named no attacker, saying only that it is working with law enforcement. North Korea routinely denies involvement in such operations and has not commented on this one; CNN and AP sought comment.

Why it matters beyond crypto, per Redbord, speaking to Al Jazeera: “When North Korea steals at this scale, the money funds weapons proliferation. This is a global security issue, not just a crypto theft.”

Your money, their promise

On Thursday, Binance suspended deposits and withdrawals outright, as a precaution. By Friday, deposits were operating normally again. Withdrawals remain paused while the company completes what it calls a security revamp of its withdrawal service and related addresses — expected, co-founder Yi He said, to resume within 48 hours.

Both Teng and Yi He have pledged that every user loss will be covered, from the company's Secure Asset Fund for Users — SAFU, a reserve of roughly $1 billion held entirely in bitcoin — and company funds. Zhao, the founder and largest shareholder, who no longer runs the company, posted that “user funds are safe” and that he expects all user funds “will be fully covered.” The scale of the promise matches the scale of the platform: 335 million registered users and about $162.8 billion in assets under custody, per the Binance figures in its 2025 annual report cited by Reuters. Binance.US, the separate American arm, says it is unaffected.

The market flinched anyway. Bitcoin fell to $76,368, a six-week low. Ether hit a two-month low at $2,178. Binance's own BNB token dropped about 5 percent, and forced liquidations across crypto ran to roughly $1.5 billion. And one detail will follow the company for a while: the wallets drained on Thursday are the same wallets Binance publishes as its proof of reserves — the public evidence that customer money is where the company says it is — as CoinDesk's review of the addresses found. The next reserve snapshot lands November 1.