“Binance Hit by USD 6.3 Billion Theft”: Record Hack Shocks Crypto Market, Repeated Security Breaches Put Investor Confidence on Alert

Binance suffers USD 6.3 billion hack attributed to North Korea-linked group
Massive outflows and plunging cryptocurrency prices persist despite pledge to cover customer assets
Repeated hacks at major exchanges, including Mt. Gox and Bybit, expose limitations of security systems

Binance, the world’s largest cryptocurrency exchange, has suffered the largest hack on record. A North Korea-linked hacking group breached its internal systems and stole a massive amount of cryptocurrency. Binance pledged to fully cover customer assets in response, but heavy withdrawal demand and declines in major cryptocurrency prices have persisted. Market observers say repeated similar incidents at other major exchanges, including Mt. Gox, Coincheck and Bybit, have deepened structural distrust in exchanges’ asset custody and management systems.

Binance Suffers Massive Asset Theft

According to a Wall Street Journal (WSJ) report on the 29th of last month (all dates local), Binance, the world’s largest cryptocurrency exchange, suffered a major hack that day in which USD 6.3 billion in cryptocurrency was stolen. Binance’s security team in Abu Dhabi, United Arab Emirates (UAE), detected signs of unauthorized withdrawals exceeding USD 1 billion from the exchange’s internal wallets. Binance management convened an emergency response team of about 100 people and moved to block further outflows, but the hackers siphoned off more than USD 6 billion in cryptocurrency in just 20 minutes. It was the largest single cryptocurrency hack on record.

Preliminary findings suggested that the hackers compromised a Binance engineer’s laptop to access the exchange’s internal systems, then exploited its transaction approval system to withdraw funds. The attacks occurred simultaneously across multiple blockchain networks, including Ethereum, Bitcoin, Tron and Solana, with USD 3.8 billion in assets drained from the Ethereum network alone. On the 31st of last month, the U.S. Federal Bureau of Investigation (FBI) officially announced that the North Korea-linked hacking group TraderTraitor was responsible.

“Full Coverage of Losses”: Binance’s Response Strategy

Following the incident, Binance urgently requested assistance from major stablecoin issuers, including Tether, Circle and World Liberty Financial, to contain further damage. These companies traced wallets that received the stolen funds and froze related assets. Assets frozen or traced during this initial response were valued at USD 3 billion. However, the hackers converted funds into Bitcoin, Ether and other cryptocurrencies to evade centralized issuers’ control. They also moved assets by depositing USD 60 million in stablecoins as collateral on the decentralized finance (DeFi) lending platform Aave and borrowing about 20,000 Ether.

As the massive losses intensified market turmoil, Binance said it would use its own resources to cover the losses in full. The exchange secured USD 6.34 billion in funding to cover the losses and began repurchasing the stolen cryptocurrencies using its Secure Asset Fund for Users (SAFU), futures insurance fund and corporate funds. On the 31st of last month, Binance announced that it had replenished about 90% of all stolen assets and held reserves equal to 100% of customer holdings in 10 major cryptocurrencies, including Bitcoin, Ether and Tether (USDT). On the 1st of this month, it raised the replenishment rate to 95% and began gradually resuming withdrawals for 15 cryptocurrencies, including Bitcoin, Ether and XRP.

Market Confidence Wavers

Despite Binance’s swift response, market anxiety has shown little sign of easing. According to Reuters, customers withdrew USD 4.65 billion in roughly 9 hours and 30 minutes after Binance resumed withdrawals. Inflows to the exchange during the same period totaled just USD 1.01 billion, leaving net outflows of approximately USD 3.64 billion—nearly 2.1% of the USD 171 billion in total assets Binance managed as of the 28th of last month.

The shock spread across the broader cryptocurrency market. Immediately after news of the Binance hack emerged, Bitcoin fell about 3% to a six-week low, while Ether also dropped more than 3%. BNB, the core cryptocurrency of the Binance ecosystem, at one point plunged more than 8% over 24 hours to USD 694. As major cryptocurrencies fell in tandem, leveraged investors faced a wave of forced liquidations in the derivatives market. According to cryptocurrency derivatives analytics firm CoinGlass, approximately 246,482 investors were liquidated across the cryptocurrency market in the 24 hours through 10 p.m. on the 29th of last month, with liquidations totaling USD 1.55 billion. Long positions betting on price increases accounted for most of that amount, at USD 1.34 billion.

Table 1. Major Cryptocurrency Exchange Hacks

A Long History of Similar Incidents

Confidence in the cryptocurrency market is visibly wavering because there have been numerous similar incidents in the past. Investor anxiety is deepening as trust in exchanges’ asset custody and management systems themselves erodes. Hacks targeting major cryptocurrency exchanges have persisted since the market’s early days. A prominent example is Japan-based Mt. Gox, then the world’s largest Bitcoin exchange, which filed for bankruptcy protection in 2014 after losing about 850,000 Bitcoin. Losses were estimated at USD 500 million at the time. In January 2018, JPY 58 billion worth of the cryptocurrency NEM was stolen from Japan’s Coincheck. At the time, Coincheck held a large amount of customer assets in an internet-connected hot wallet.

In May 2024, 4,502.9 Bitcoin were stolen from Japanese cryptocurrency exchange DMM Bitcoin, causing losses of USD 308 million at market prices at the time. In July of the same year, USD 230 million in cryptocurrency was stolen from India’s WazirX. The hackers attacked a multisignature wallet linked to external custodian Liminal and seized smart contract execution permissions. WazirX suspended cryptocurrency and local-currency withdrawals to prevent further losses.

Stronger Security Still Proves Helpless

Global cryptocurrency exchange Bybit also suffered the theft of USD 1.5 billion worth of Ether in February last year. The hackers compromised the developer systems of Safe, the multisignature wallet service used by Bybit, and inserted malicious code into the transaction approval screen. They manipulated transaction details so that control of the wallet would pass to the attackers when exchange employees approved what appeared to be a routine internal funds transfer. This explains why Bybit failed to prevent the breach despite using a multisignature system and an offline cold wallet.

The problem is that even as these exchanges improved their asset custody methods and expanded safeguards in response to mounting losses, attackers continued to develop ways to bypass them. One market expert noted, “Simply storing assets in offline wallets or adding transaction approval steps cannot completely eliminate the risk of hacking,” adding, “As exchanges’ asset holdings grow, a single security breach can cause enormous losses. Stronger security measures must therefore encompass internal access management, transaction approval procedures and systems for vetting external custodians.”