Binance, the world’s largest cryptocurrency exchange, is dealing with what analysts describe as the biggest theft in the history of digital assets. About $6.3 billion was moved out of its wallets this week, and the exchange paused deposits and withdrawals while it investigated.
Blockchain analytics firm TRM Labs says roughly $6.36 billion left Binance wallets across ten blockchains, most of it within about 20 minutes. It attributed the attack with high confidence to TraderTraitor, a North Korean state hacking unit. Chainalysis reached the same conclusion and put the haul at about $5.9 billion at the time of the theft. Either figure is roughly four times the previous record, the $1.5 billion taken from the Bybit exchange in February 2025, which was also blamed on North Korea.
How the attack happened
Binance’s early findings point not to a broken blockchain but to a single person’s computer. Co-chief executive Richard Teng said the attack may have started with a compromised laptop belonging to a DevOps engineer. From there, the attacker reached a service container inside Binance’s systems and submitted withdrawal transactions that were never authorised. The exchange said it had found no evidence that wallet private keys had leaked. Teng described the investigation as initial and stressed that the attack was complex rather than a one-click intrusion.
The industry reacted quickly. Stablecoin issuers Tether and Circle froze large amounts of the stolen funds: Tether’s chief executive said more than 1.5 billion USDT had been locked, and Circle froze more than 800 million USDC. Lending protocol Aave froze its markets as a precaution to stop the attacker from borrowing against stolen assets. Binance said about $3 billion had been frozen on-chain so far, while other estimates suggested close to $2.9 billion was still sitting in attacker-controlled wallets.
Binance has said customers will not bear the losses. It plans to cover them from its SAFU emergency fund, which holds 15,000 bitcoin, and from company funds. Its US affiliate, Binance.US, said it was a separate platform and was not affected. As of Friday, the exchange said it expected withdrawals to resume within 48 hours.
What it means here
For Bangladeshi readers, the name behind the attack will sound familiar. North Korean hackers were blamed by US authorities for the 2016 theft of $81 million from Bangladesh Bank’s account at the Federal Reserve Bank of New York. A decade on, the same state-backed groups have moved from bank payment messages to crypto platforms, where funds can be moved and laundered far faster.
Bangladesh Bank has repeatedly warned that trading in virtual currencies has no legal backing in the country, so few local users should be directly exposed through regulated channels. Some Bangladeshis do use offshore exchanges informally, and they would have found their accounts frozen this week with little legal recourse at home.
The broader lesson applies to banks, mobile financial services and fintech firms here. The weak point was not cryptography but an employee device with access to production systems. Limiting what engineers’ machines can reach, using hardware security keys, separating admin workstations and requiring several approvals for large transfers are basic controls that matter as much to a bank or an MFS provider in Dhaka as to a global exchange. As more of Bangladesh’s money moves through apps and cloud systems, the attack surface shifts from the vault to the laptop.
