How the record-breaking $6.3 billion heist in crypto history unfolded

Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record digital asset theft.

About $6.3 billion of cryptocurrencies were drained from wallets that Binance uses to process transactions, according to the exchange and expert analysis of blockchain records.

Binance said in a statement on X that it initially thought the attack involved a compromised laptop. "However, our subsequent investigation has uncovered additional points of breach," it added, without elaborating.

The exchange operates a secure asset fund for users, a $1 billion bitcoin reserve designed to protect customers in the event of a security breach, according to its website.

Co-CEO Richard Teng said losses would be covered by the fund and company resources.

According to US blockchain analytics firm TRM Labs, the attackers compromised Binance's "signing infrastructure", which authorizes transactions, allowing them to issue instructions that emptied the affected wallets.

The bulk of the heist unfolded in about 20 minutes, blockchain records show, beginning shortly after 2000 GMT on Thursday.

Once the funds were moved, the attackers raced to shift them beyond the reach of Binance counterparties and stablecoin issuers, which have frozen roughly half of the stolen assets.

An unusual feature of some cryptocurrencies, including major stablecoins such as Tether's USDT and Circle's USDC, is that their issuers can freeze them remotely.

"In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," said Joshua Chu, a Hong Kong lawyer who works on crypto cases.

Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers.

Teng said Binance's investigation had not yet identified the attackers, while North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts. North Korea's mission in Geneva and embassy in China did not immediately respond to requests for comment.

TRM said the breach shared characteristics with last year's attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers. The firm said it was highly confident the same group was behind the Binance theft.

Chainalysis said funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach.

About half the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture.