Binance Hack: How North Korea Pulled Off a $6.3 Billion Crypto Heist

Twenty minutes. That's roughly how long it took for $6.3 billion to leave Binance's wallets on October 29 — the single biggest theft in crypto's history, bigger than the GDP of several small countries, and it started with one employee's laptop.

From a Laptop to the Biggest Heist Ever

Binance's own early account is almost mundane for how much damage it describes: a DevOps engineer's laptop — DevOps being the team that keeps an exchange's servers and deployment pipelines running day to day — got compromised, and that access eventually reached an internal service container tied to withdrawal systems. From there, attackers pushed unauthorized withdrawal requests across roughly ten different blockchains before anyone could react. Blockchain analytics firm TRM Labs puts the total outflow at around $6.36 billion, most of it gone in about twenty minutes.

Binance co-CEO Richard Teng pushed back on the idea that it was really that simple, though. In a video statement, he said the intrusion was "a more complex attack process" than a single stolen laptop implies, with multiple points of entry Binance is still mapping out. He also said customer funds held in cold storage — wallets kept fully offline, away from any network a hacker could reach — were never touched, and that no private keys were leaked.

"This was not a simple one-person job — it was a more complex attack process," Binance co-CEO Richard Teng said, adding that customer cold-storage funds were never touched.

Why Everyone's Pointing at North Korea

The FBI has attributed the attack to TraderTraitor, a hacking unit tied to North Korea's broader Lazarus Group — the same cluster blamed for a string of exchange heists over the past few years. Chainalysis separately said it has high confidence in the same attribution. It fits a pattern: Pyongyang's state-linked hacking teams have increasingly treated crypto exchanges as a funding source, reportedly channeling stolen funds toward weapons programs that sanctions were meant to choke off.

Not all of it got away clean. Blockchain investigator Elliptic says roughly $2.85 billion has already been frozen or seized across various platforms as exchanges and law enforcement raced to flag the stolen funds before they could be laundered through mixers and bridges. That's a sizable dent, but it still leaves well over half the haul in the attackers' hands.

• ~$6.36 billion drained across ten blockchains in about 20 minutes
• Entry point: a compromised DevOps engineer's laptop, followed by additional access points Binance hasn't fully detailed
• ~$2.85 billion already frozen or seized by investigators and partner platforms
• Binance has set aside $6.34 billion of its own money — about $5 billion already held in the exact tokens stolen — to make every affected user whole

What This Means If You Trade on Binance From India

Binance isn't some niche platform for Indian traders — it's one of the exchanges a huge share of India's retail crypto volume actually flows through, especially since domestic platforms carry India's 30% capital gains tax plus 1% TDS on every trade, pushing many users toward offshore apps instead. That's exactly the exposure this incident highlights: if an offshore exchange gets drained, Indian users have no deposit insurance scheme to fall back on — nothing like the DICGC cover that protects bank deposits — and no realistic path to an Indian court or regulator forcing a foreign company to pay up. Binance choosing to cover losses from its own balance sheet this time is a business decision, not a legal obligation anyone in India could have enforced.

It also lands right as RBI keeps signaling it isn't interested in giving crypto exchanges any kind of regulatory safety net — a stance Code24 covered in detail when the central bank doubled down on blockchain while staying wary of crypto itself. A hack of this size, on a platform this widely used, is likely to harden that caution rather than soften it, even as it has nothing to do with how any Indian exchange actually operates.

The Part That Should Worry Every Exchange

This wasn't a smart-contract bug or a flaw in blockchain code — it was a human being's work laptop. That's a far more ordinary attack surface than the elaborate exploits exchanges usually prepare for, and it's a lot harder to patch than a line of code. Expect exchanges everywhere to start treating employee device security, not just wallet architecture, as core infrastructure.

Binance says a full proof-of-reserves report is coming to show exactly what's left and what's been restored, and withdrawals have been gradually reopening as systems get rebuilt and retested. Whether this becomes the incident that finally forces exchanges to lock down employee access the way they've locked down their cold wallets, or just another record that gets broken again next year, depends entirely on what Binance — and its rivals watching nervously from the sidelines — actually change in the coming months.