World’s Largest Crypto Exchange Binance Hacked in Record $6.3 Billion Theft

$6.3 Billion in Crypto Stolen in Hack

Binance, the world’s largest cryptocurrency exchange, was hit by a hack that is estimated to have drained $6.3 billion in digital assets. It marks the largest crypto hacking incident on record. The attack is believed to have been carried out by a North Korea-linked group, raising fresh concerns about security at South Korean crypto exchanges.

Binance said on Oct. 30 that about $6.3 billion worth of crypto was stolen in the hack, which took place on Oct. 29. The exchange said it froze about $3 billion of those assets. That step prevents the hackers from moving the funds further, but does not amount to a recovery of the assets.

A preliminary investigation found that the hackers may have accessed internal services through a laptop used by a development and operations engineer before executing unauthorized withdrawal transactions, Binance said. Bitcoin fell more than 5% at one point that day, dropping below $80,000.

While Hacks Spread, No South Korean Crypto Exchange Has Undergone a Full Security Review

North Korean Hacking Group Seen as Likely Culprit, With Calls for Preemptive Security Checks

Most of the digital assets stolen from Binance were moved to wallets controlled by the hackers in just 20 minutes. The estimated loss is more than four times the $1.46 billion stolen in the Bybit hack in February last year, making it the largest such theft ever.

According to blockchain analytics firm TRM Labs, the hackers stole $6.36 billion worth of digital assets from Binance-managed wallets across 10 blockchains, including Ethereum, Bitcoin, Tron and Solana. Of that total, $1.47 billion came from Bitcoin and $3.79 billion from Ethereum.

The breach occurred after the hackers infiltrated a system that manages wallets, approved withdrawal transactions without authorization and moved the assets out. Binance temporarily suspended deposits and withdrawals after the incident and began tracking the stolen funds with investigative authorities. Stablecoin issuers including Tether and Circle also froze assets in wallets linked to the hack. Binance said customer assets are safe and that losses will be covered through its user protection fund and company funds.

TRM Labs said the attack was likely carried out by TraderTraitor, a North Korean hacking group. The group was also identified as the likely force behind the Bybit hack in February last year.

Concerns are also growing that South Korean exchanges are not immune to hacking risks. In November last year, Upbit suffered an outflow of about $32.1 million in Solana-based digital assets. On Oct. 24, about $72,000 was stolen from the hot wallet, or internet-connected wallet, of smaller exchange PraBang.

Under South Korea’s Virtual Asset User Protection Act, exchanges must keep more than 80% of customer crypto assets in cold wallets that are separated from the internet. They are also required to carry insurance or mutual aid coverage against hacking and to set aside reserves. Even so, an industry official said hot wallets used for customer deposits and withdrawals, as well as exchanges’ internal systems, cannot be completely insulated from hacking risks.

There is also a system designed to check security vulnerabilities in advance, but its use has been limited. The Financial Security Institute established specialized security assessment standards for virtual-asset exchanges late last year. The framework reviews vulnerabilities in blockchain systems, wallets and smart contracts, as well as servers and networks. But as of Oct. 19, not a single operator had applied for the comprehensive security inspection.

Cho Mi-hyun, Hankyung.com reporter, mwise@hankyung.com