The world’s largest cryptocurrency exchange Binance has been hit with the biggest ever cryptocurrency heist, in which billions of dollars of reserves were drained in just 20 minutes.
At 8:05pm on 29 October, $6.36 billion in cryptocurrencies were shifted from wallets in a coordinated attack believed to have originated from a North Korean-linked hacking group called TraderTraitor. This group was also behind a $1.5 billion hack of the Bybit crypto exchange in February 2025.
The US Treasury has previously said that such stolen funds are used to finance North Korea’s nuclear missile programme.
Advertisement
Despite cryptocurrency’s founding idea of decentralisation, meaning no one has singular control over the money flowing through the network, there are some large single points of failure. It is believed one of these was the cause of the hack, which gave access to a system Binance uses to authorise transfers out of customers’ accounts.
Read moreQuantum computer quickly mines cryptocurrency while using less energy
In a statement, Binance said its early investigations indicate the security incident may stem from a compromised laptop belonging to an engineer. TRM Labs, a cybersecurity firm, suggests that preparations for the attack may have begun several days ago.
The company claims it has found no evidence to suggest the private cryptographic keys used to authorise transactions were stolen. Instead, the attackers appear to have gained access to the software that requests withdrawals, potentially allowing them to instruct Binance’s own systems to approve the transfers. However, the investigation is continuing and the firm has said in a subsequent statement there may have been “additional points of breach”.
“It shouldn’t be possible for a single [developer] PC to be compromised and somehow for that to allow the entire exchange to be compromised,” says Alan Woodward at the University of Surrey, UK. “I don’t understand how that can happen unless they’ve got the most ridiculous operational security.”
If that is the case, it highlights how precarious major financial hubs in the crypto world can be to single points of failure.
Free newsletter
Sign up to The Weekly
Sign up to newsletter
“You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened,” says Clive Summerfield at FARx, a cybersecurity company. “Most crypto platforms are as centralised as any bank, with a small number of privileged individuals controlling billions. The difference is that once crypto is transferred, it’s gone.”
That centralisation can be a blessing as well as a curse, though: cryptocurrencies Tether and Circle have been able to freeze billions of dollars of stolen coins, stymying the hackers in attempts to transfer about half the stolen funds any further.
Woodward says the Binance incident potentially strikes a distinction between crypto security and more traditional finance. “You would hope there’d be things like two-man rules [where two separate people have to approve a change] or things that banks have for changing critical systems, but it doesn’t look like those were in place.”