Finance1 min read

Gone in 20 minutes: How the biggest heist in crypto history unfolded

By · Published by Everything Blog

In short

Attackers initiated the record-breaking cyberattack shortly after 8 p.m. GMT, siphoning the vast majority of the assets in a brief 20-minute window. Binance co-CEO Richard Teng confirmed that corporate resources and a dedicated US$1 billion secure asset fund will fully cover customer balances. While stablecoin firms successfully froze nearly half the loot, analytics firms observed stolen funds being commingled with assets from an earlier Bitget platform breach. An estimated US$2.4 billion in bitcoin and ether remains unfreezable, leaving security analysts bracing for complex laundering maneuvers across less regulated exchanges.

Key points

  • Binance plans to completely backstop the unprecedented US$6.3 billion customer shortfall…: Binance plans to completely backstop the unprecedented US$6.3 billion customer shortfall using corporate assets and its emergency fund.
  • Blockchain investigators noted operational similarities to state-sponsored North Korean c…: Blockchain investigators noted operational similarities to state-sponsored North Korean cyber operations, though Binance has not yet verified the culprits.
  • Attackers face significant barriers to cashing out frozen stablecoins but are actively mi…: Attackers face significant barriers to cashing out frozen stablecoins but are actively mixing remaining funds with loot from other exchange exploits.

Sources checked by our analysis pipeline: 1

"The attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," says a lawyer who works on crypto cases.

SINGAPORE: Hackers stole US$6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record digital asset theft.

WHAT HAPPENED?

About US$6.3 billion of cryptocurrencies were drained from wallets that Binance uses to process transactions, according to the exchange and expert analysis of blockchain records.

Binance said in a statement on X that it initially thought the attack involved a compromised laptop.

"However, our subsequent investigation has uncovered additional points of breach," it added, without elaborating.

The exchange operates a secure asset fund for users, a US$1 billion bitcoin reserve designed to protect customers in the event of a security breach, according to its website.

Co-CEO Richard Teng said losses would be covered by the fund and company resources.

According to US blockchain analytics firm TRM Labs, the attackers compromised Binance's "signing infrastructure", which authorises transactions, allowing them to issue instructions that emptied the affected wallets.

The bulk of the…

Finance