The World’s Biggest Crypto Heist

Binance, the world’s largest cryptocurrency exchange, was hit by a massive cyberattack late Thursday. The suspected hackers took $6.36 billion in digital coins across 10 blockchains. Experts call it the biggest crypto heist in history because of its extraordinary size and speed. It matters because the attack exposed risks in a largely unregulated industry.

TRM Labs identified an elite North Korean group called TraderTraitor as the likely attacker. The hackers did not enter consumer accounts. Instead, they affected Binance’s corporate holdings. Around $3 billion in assets were located or frozen, while roughly $2.4 billion moved beyond any issuer’s reach.

Binance said customer assets were safe and promised cooperation with law enforcement. Still, the incident shook confidence across the market. Bitcoin fell more than 5 percent, while other exchanges lost as much as 9 percent. It also highlighted North Korea’s growing cyber capabilities.

The suspected attackers stole $6.36 billion in Binance digital coins. TRM Labs said the assets were spread across 10 blockchains. That figure makes the incident the largest crypto heist in history, according to experts cited in the article. The theft also showed how quickly digital assets can move once attackers gain access.

The hackers acted late Thursday and completed the main theft in under 30 minutes. The article’s headline describes the event as taking place in 20 minutes, while its account says under 30 minutes. Around $3 billion in assets had already been located or frozen. About $2.4 billion had moved beyond any issuer’s reach.

The scale affected the wider market, not only Binance. Bitcoin’s value dropped more than 5 percent overnight from Thursday into Friday. Other cryptocurrency exchanges fell as much as 9 percent. The speed and size raised fresh questions about crypto security and oversight.

Binance is the world’s largest cryptocurrency exchange, according to the article. A cryptocurrency exchange provides a platform for buying, selling, trading, and storing digital coins. Binance holds assets for customers and also manages corporate holdings. The attack affected the company’s holdings, while consumer accounts were not accessed.

A bank typically handles government-issued money, provides deposits and loans, and operates within a formal regulatory system. An exchange mainly connects crypto buyers and sellers and helps transfer digital assets between wallets. Some exchanges may offer services resembling banking, but they are not automatically banks. Their rules and protections can differ widely.

This distinction matters because cryptocurrency remains relatively new and largely unregulated. Binance co-CEO Richard Teng said customer assets were safe after the attack. Even so, analysts said the heist exposed risks in trading crypto. The market reaction showed that one exchange’s security failure can affect prices elsewhere.

The article reports a crucial boundary in the attack: consumer accounts were not accessed, while Binance’s corporate holdings were affected. That meant customers did not directly lose their deposited assets. Binance co-CEO Richard Teng therefore told customers, “Your assets are safe.” The incident still caused major concern because the company itself lost billions.

The exact technical reason for this separation is not given. In general, exchanges keep corporate funds and customer funds in different accounts, wallets, or permission systems. Access controls can limit what an attacker reaches. Here, the available evidence shows only that the hackers obtained control over Binance holdings designated as corporate, not customer accounts.

That distinction reduced the immediate effect on users but did not eliminate the broader danger. Analysts said the heist exposed weaknesses in crypto trading. Bitcoin fell more than 5 percent, and other exchanges dropped as much as 9 percent. The case shows why internal separation and strong access controls matter.

Cryptocurrency transactions are recorded on blockchains, creating trails that specialist investigators can analyze. Firms such as TRM Labs can track where stolen coins move across wallets and blockchains. If assets reach a cooperative exchange or issuer, that organization may identify, freeze, or recover them. This explains how around $3 billion connected to the Binance attack was located or frozen.

The article gives a concrete split. TRM Labs estimated that roughly $2.4 billion in coins had moved “beyond any issuer’s reach.” That phrase means the assets were no longer held where a company could directly stop transfers or reverse them. Moving coins across multiple blockchains can make coordination harder, although the article does not describe the exact routes.

Tracing is therefore possible, but recovery is not guaranteed. Analysts can follow public transaction records without controlling the wallets involved. Issuers can act only where they have authority or technical control. The Binance case shows both sides: billions were found or frozen, while billions more remained outside any issuer’s reach.

North Korean hackers are suspected because TRM Labs had “high confidence” that TraderTraitor carried out the attack. The group was described as an elite North Korean hacking unit. A former South Korean vice defense minister called North Korean hackers among the world’s most aggressive and highly skilled cyber actors. Their repeated record of crypto theft strengthens the suspicion.

The article cites several examples. The FBI said TraderTraitor stole $1.5 billion from Bybit in February 2025. South Korea’s spy agency accused North Korean hackers of stealing about $1.1 billion over five years. Chainalysis estimated that Pyongyang’s hackers stole around $2 billion in cryptocurrency last year, about 60 percent of global crypto heists.

The article says Russia uses cryptocurrency to evade sanctions and obtain sensitive dual-use goods. It does not specifically state how North Korea spends every stolen coin. However, the repeated thefts show why cryptocurrency may be valuable to a sanctioned government. The Binance investigation continues with law-enforcement cooperation.

Cryptocurrency is a digital asset that can be transferred between electronic wallets. Blockchains record transactions across networks of computers rather than in one central database. This design can let people send and verify value without relying entirely on a government or commercial bank. The article describes crypto as a relatively new economic phenomenon that remains largely unregulated.

Decentralization does not make cryptocurrency automatically safe. Ownership depends on controlling the credentials and systems that authorize transfers. Exchanges also hold large pools of assets, creating attractive targets. In the Binance case, hackers affected corporate holdings across 10 blockchains, while consumer accounts remained untouched. Investigators then followed some assets and helped freeze them.

Values can change quickly because markets trade continuously and confidence can shift. Bitcoin fell more than 5 percent after the heist, and other exchanges fell as much as 9 percent. Decentralized networks can preserve transaction records, but users and companies still need strong security. The attack shows that network design cannot prevent every theft.