Binance has suffered the largest cryptocurrency theft ever recorded: around $6.3 billion was taken from its wallets on the night of 29 October. What is unsettling is not only the amount, but also the method. The attackers, whom blockchain analytics firms have linked to North Korea, achieved something more effective than cracking a private key: they got Binance’s own systems to sign transactions on their behalf.
What happened at Binance?
Binance, the world’s largest cryptocurrency exchange, with more than 300 million users, confirmed a security incident in the early hours of 29–30 October involving around $6.3 billion in customer assets. The company suspended deposits and withdrawals, promised to cover all losses and set aside $6.34 billion to do so.
Stablecoin issuers and other partners have frozen around $3 billion. The rest remains in the attacker’s hands, mainly in ether and bitcoin. According to on-chain analysis, most of the funds were moved in around 20 minutes across ten different blockchains.
The amount is four times the previous record: the $1.5 billion stolen from Bybit in February 2025, which the FBI attributed to North Korea. Binance expects to reopen withdrawals in around 48 hours, once it has finished rebuilding the security of that service.
What happens now to Binance users’ money?
Binance has promised that its customers will not bear the losses from the hack: it will cover them through its Secure Asset Fund for Users (SAFU) emergency fund and its own resources, and has set aside $6.34 billion for this purpose. In the meantime, deposits and withdrawals remain suspended, and the platform expects to reopen them in around 48 hours, once it has finished rebuilding the security of that service.
It will also publish an updated proof of reserves once the incident has been resolved. Be alert over the coming days: Binance itself has warned about scams, and a theft of this scale creates ideal conditions for fake technical-support services and ‘fund recovery’ websites. No legitimate platform will ask for your keys, codes or a transfer of funds to return your money. There is one further point for users operating from the EU: Binance does not appear in ESMA’s register, so this compensation depends on the company’s word rather than a legal obligation.
How was Binance hacked? From an engineer’s laptop to the hot wallet
Binance’s preliminary investigation points to a rather uncinematic entry point: a compromised laptop belonging to a DevOps engineer. From there, the attacker reached a service container and sent withdrawal instructions that the platform had never authorised. Binance says there is no indication that any private keys were leaked.
That distinction changes everything. A hot wallet is the wallet an exchange keeps connected to process withdrawals immediately, and its security depends on who is able to ask it to sign. According to the on-chain analysis reported by The Hacker News, the attacker prepared the operation at least 36 hours in advance and then executed a batch of authorisations that had been pre-signed by Binance’s own wallet.
Binance co-CEO Richard Teng clarified that the attack did not rely solely on the permissions of one engineer and was not the result of a single click, but rather a complex operation. The company has already identified other points of intrusion in addition to the laptop and will publish a full technical analysis once the investigation is complete, according to Euronews.
North Korea and Lazarus: the usual suspect and its favourite way in
Once again, we are talking about state-linked hackers. Blockchain analytics firms attribute the attack, with a high degree of confidence, to TraderTraitor, a unit linked to the Lazarus Group and the Pyongyang regime. This is the same group the FBI identified in connection with the Bybit theft. Caution is warranted: neither Binance nor any government has confirmed responsibility, and some analysts warn that the laundering activity does not entirely follow the group’s usual patterns.
What is documented is how these actors typically gain access. In August 2025, Binance’s head of security told Decrypt that the platform receives fake CVs every day from alleged North Korean operatives, who attend interviews using deepfakes and voice changers. He added that almost every major hack attributed to North Korea has involved a fake employee. Another route is the fake job offer: an interview, an alleged video failure and a link to ‘update’ an application that infects the device.
Analysts suggest that this attack may have started in the same way, with a technical test or fake project that led an employee to run malware, as happened in the DMM Bitcoin and Bybit incidents. If the attribution is confirmed, this is not opportunistic cybercrime: Pyongyang uses these thefts to fund its economy and nuclear programme under UN sanctions. It is a state operation, with patience, resources and a method.
Binance and MiCA: the difference between a promise and a right
In July, we reported here that Binance could no longer provide services in the European Union because it did not hold a MiCA licence, and that what users lose without a licence is not access, but protection. This hack puts that statement to the test. Binance remains absent from ESMA’s register of authorised providers, and France’s AMF removed its French subsidiary from the register on 2 July.
Binance has promised to cover all losses and has set aside funds to do so—something it deserves credit for. But outside MiCA, that coverage is a company decision; under MiCA, it is an obligation. Article 75 of the regulation makes custodians liable to their clients for the loss of crypto-assets resulting from incidents attributable to them, up to the market value of the assets lost. It also requires them to have a custody policy that minimises the risk of fraud, cyber threats or negligence, and to specify the customer authentication system in the contract.
This should not be misread: no licence can stop a state actor. What changes is who is held responsible when an incident occurs, and what security standard is required beforehand. For anyone in the EU who still holds funds on Binance, the difference between a promise and a right has just become more than theoretical.
The lesson from the Binance hack: identity is the new perimeter
The case leaves the entire sector with an uncomfortable lesson: cryptography can be secured, and yet everything can still be lost if the identity of the person operating the system is not protected. That identity comes into play at three points.
- Who gets in. If an attacker enters as a candidate using a deepfake in an interview, or as a recruiter with an irresistible job offer, verifying that the person on the other side of the camera is real and is who they claim to be is no longer just a recruitment formality. It becomes a security control.
- Who signs. A multimillion-dollar withdrawal should not depend solely on one system trusting another. Authenticating the person behind every critical operation and continuously monitoring behaviour during privileged access can turn a compromised laptop into an alert rather than a theft.
- Who receives the money. $6.3 billion does not spend itself: the stolen funds need an exit route, and KYC checks and the detection of mule accounts at destination exchanges are their bottleneck. The freezing of around $3 billion by stablecoin issuers shows that compliance does not just prevent crime; it also helps contain it.
Verifying the customer’s identity is not enough. We need to verify everyone who can move their money, who can sign on their behalf and, increasingly, even establish on whose behalf AI agents are acting.
