How did hackers steal $6.3bn from Binance?

The world's largest cryptocurrency trading venue suffered the most severe digital asset theft in history when attackers siphoned around $6.3 billion in virtual currencies. The unauthorized transactions started late in October from the platform's hot wallets, which are internet-connected repositories maintained to process ordinary customer withdrawals.

Initial blockchain traces showed significant volumes of Ether alongside dozens of alternative digital tokens transferred to freshly created addresses funded through obfuscation services. The stolen sum represented roughly two percent of the $171 billion in total client assets held across the platform. Binance temporarily froze all customer cash-outs and trading activity while technicians isolated the problem.

Company investigations revealed that perpetrators approached a technical staff member through a legitimate hiring network. The hackers fabricated recruiter personas with authentic-looking social media accounts and conducted simulated evaluations.

During an interview, the worker downloaded an evaluation file containing evasive malware designed to evade corporate defenses. Once the employee's laptop was penetrated, the intruders commandeered an internal artificial intelligence tool in October. That access allowed them to compromise machines used by two other technical personnel, opening the door to the exchange's transaction mechanisms.

The Federal Bureau of Investigation, working alongside the United States Secret Service and Internal Revenue Service investigators, tied the breach to TraderTraitor, an outfit also identified as the Lazarus Group. United States blockchain research firms shared similar assessments. The same faction had been accused of taking $1.5 billion from another trading service, Bybit, in 2025.

Federal authorities warned that stolen funds were rapidly being converted into Ethereum and laundered through decentralized finance services and thousands of scattered wallets. US officials published associated cryptocurrency addresses and called on global platforms to freeze incoming transactions tied to the theft.

Pyongyang vehemently rejected the United States allegations. Kim Yo Jong, an influential ruling party director and sister of North Korean leader Kim Jong Un, characterized the FBI assessment as a hostile move aimed at damaging North Korea's international reputation.

The accusations also impacted diplomatic overtures. While United States President Donald Trump expressed willingness to engage in direct talks if North Korean involvement was verified, Kim Yo Jong announced that Pyongyang had no intention of speaking with Washington. She insisted the United States must first discard antagonistic policies, pointing to joint military drills with South Korea and American sanctions.

Binance restored client services on Sunday, prompting an initial surge where customers withdrew roughly $3.6 billion in net capital over nine and a half hours before fund movements stabilized. The international platform absorbed the hit using corporate savings, insurance coverage, and its user protection fund, restoring nearly all compromised balances.

The theft occurred amid widespread digital disruptions across other sectors. European grocery stores dumped spoiled goods after cyber incidents drove cooling units above safe temperatures, South Korean authorities replaced passports for senior officials following an online data leak, and civil defense applications in both Ukraine and Russia were infiltrated to deliver fake hazard alerts.

Binance plans to commission an independent cybersecurity review, increase investment in defensive artificial intelligence, and establish a dedicated security research endowment while working to replenish less liquid tokens.