Binance became the target of the largest digital asset theft in history, with 6.3 billion USD withdrawn in just 20 minutes.

Large-scale, well-prepared attack

On October 29, cryptocurrency exchange Binance became the target of one of the largest digital asset thefts in history. According to WIRED, hackers withdrew about $6.3 billion from Binance wallets on at least 10 blockchains, including Bitcoin, Ethereum, Tron, and Solana. Notably, most of this money was transferred within just 20 minutes.

Immediately after discovering the problem, Binance temporarily suspended deposits and withdrawals to conduct an investigation. The exchange pledged to compensate all losses and coordinate with law enforcement agencies to track down those behind the attack.

Although most of the assets were withdrawn in a short period of time, the attack was not sudden. Preparations began at least 36 hours before the money was stolen. Hackers took control of one of the wallets and made three small transactions to test the process before launching a large-scale attack.

On the morning of October 29, hackers deployed the first version of the attack code and tested it on two wallets. The finished version is then tested on a third wallet before the test funds are transferred back to the attacker's address. About 4 hours after the last drill, the same code appeared on a Binance hot wallet.

Hot wallets are wallets that connect directly to the Internet, often used by digital currency exchanges to process customer withdrawal transactions. Recently, hot wallets have become an attractive target for hackers. According to Reuters, the attackers appear to have infiltrated Binance's transaction signing and approval infrastructure, thereby sending a series of unauthorized withdrawal requests.

Initially, Binance said the incident may be related to a compromised DevOps engineer's laptop. However, subsequent investigation discovered many other intrusion points, showing that this was a complex attack.

After gaining the right to execute transactions, speed becomes the deciding factor. Binance wallets on multiple blockchains simultaneously had their assets withdrawn, with thousands of transactions being processed quickly.

Chainalysis said the money laundering patterns that emerged later were different from what had been seen before, suggesting that hackers used automated systems to make tracing difficult.

About $2.8 - 3 billion in assets were frozen after the attack, mostly stablecoins, while the remaining about $3.3 billion were in Bitcoin, Ether, and XRP, which cannot be directly frozen.

FBI blames North Korean hacker group

Immediately after the incident, three cryptocurrency tracking companies including TRM Labs, Chainalysis and Elliptic detected signs that the attack may be related to North Korean hackers. The FBI has officially blamed the TraderTraitor group, the group that was accused of stealing $1.5 billion from the Bybit exchange in 2025.

The incident not only caused huge financial losses but also raised questions about the safety of the custody and transaction approval infrastructure at centralized cryptocurrency exchanges. The 20-minute period only reflects the speed with which most assets were withdrawn, while it was the result of at least 36 hours of preparation and testing before the hackers performed a series of transactions almost simultaneously.