ISLAMABAD – Billions of dollars vanished from leading cryptocurrency exchange Binance wallets in matter of minutes, leaving crypto-world stunned. As investigators race to trace staggering $6.3 billion heist, suspicion is turning towards North Korea’s Lazarus hacking network. But did Pyongyang really mastermind what could be the biggest crypto theft in history?

The extraordinary cyberattack, which hits world’s largest cryptocurrency exchange, jolted global digital asset market after hackers allegedly moved billions of dollars out of Binance-controlled wallets, with most of the theft unfolding within half an hour. The amount stolen is more than four times the $1.5 billion lost in the infamous Bybit breach in February 2025, showing unprecedented scale of latest attack.

Binance hit by $6.3b hack in potentially biggest crypto heist in history

While perpetrators have not been officially identified, two major blockchain intelligence firms, TRM Labs and Chainalysis, have expressed high confidence that North Korean cybercriminals were responsible. The suspected organisation is TraderTraitor, a sophisticated hacking operation associated with the Lazarus Group, which has previously been linked to major cryptocurrency thefts.

North Korea under Spotlight over Crypto Theft

Investigators believe Binance operation bears striking similarities to earlier attacks attributed to North Korean state-linked hackers. TRM Labs said its investigation uncovered technical patterns and operational methods consistent with previous TraderTraitor campaigns.

Chainalysis reported suspicious movements of stolen cryptocurrency, including transactions in which assets linked to the Binance breach were mixed with funds from another recent exchange attack widely attributed to North Korean actors. The findings have strengthened suspicions that the same hacking network may be responsible for multiple major cryptocurrency thefts.

North Korea repeatedly denied accusations of sponsoring cybercrime, while Binance has not confirmed any connection between the attackers and Pyongyang. For years, Western authorities have accused North Korean hacking organisations of stealing cryptocurrencies to generate foreign currency, evade international financial restrictions and potentially support the country’s weapons programmes.

However, the latest allegations remain intelligence assessments rather than a confirmed finding by law enforcement authorities.

The scale of the operation has raised serious questions about the security systems protecting the world’s biggest cryptocurrency exchange. Binance co-CEO Richard Teng disclosed that the attackers carried out a complex, coordinated intrusion rather than simply exploiting a single employee’s compromised computer.

An initial investigation suggested that a developer’s laptop had been breached, potentially providing access to internal systems.

According to blockchain security researchers, the attackers manipulated transaction-authorisation mechanisms involving Ethereum’s EIP-7702 functionality, enabling malicious instructions to drain cryptocurrency from an internet-connected wallet. The operation involved multiple blockchains, with digital assets rapidly transferred into addresses controlled by the attackers.

Teng also described the use of a self-destruct mechanism designed to erase parts of the attackers’ tools and reduce the digital evidence available to investigators. Binance has said it has not found evidence that wallet private keys were leaked.

US Secret Service on Hunt for Stolen Money

US Secret Service becomes involved in investigation, working alongside financial crime specialists, private-sector partners and law enforcement agencies. Investigators are attempting to trace the stolen assets, identify cryptocurrency addresses used by the attackers and prevent the funds from being converted into other digital currencies or withdrawn through exchanges.

The agency is coordinating with the US Attorney’s Office for the District of Columbia and other authorities to identify those responsible and potentially bring criminal charges. FBI has also acknowledged awareness of the incident. Authorities have cautioned that the investigation remains at an early stage, with further details expected as forensic teams examine the breach.

Despite unprecedented theft, Binance and its partners have made progress in restricting access to some of the stolen cryptocurrency. The exchange said approximately $3 billion in affected assets had been located, while stablecoin issuers and blockchain organisations moved to freeze billions of dollars linked to the attack.

Companies involved in restricting stolen assets include Tether and Circle, whose digital currencies were among those targeted. However, freezing cryptocurrency does not automatically mean the money has been recovered or returned to Binance. The exchange has pledged to cover customer losses and allocated more than $6.34 billion in company funds and assets to address the financial impact.

Binance also temporarily suspended withdrawals while engineers conducted additional security checks. Teng said the platform would restore withdrawal services only after completing rigorous testing, with an updated proof-of-reserves report planned to reassure customers about the exchange’s holdings.

Biggest breaches so far

Binance theft alone exceeds the combined losses from these three previous major incidents. Security experts have also warned that cryptocurrency criminals are increasingly targeting individual investors through online fraud, stolen credentials and even physical intimidation intended to force victims to reveal private wallet keys.

The growing value of digital assets has made both large exchanges and ordinary cryptocurrency holders attractive targets. For Binance, which serves hundreds of millions of registered users worldwide, the attack represents one of the most serious security challenges in cryptocurrency history.