Decoding the $6.3 Billion Binance Heist

On October 29, Sam Kessler saw signs on social media that Binance, the world’s largest cryptocurrency exchange, might be losing money from one of its accounts. He alerted Bob McMillan, suggesting it could become the biggest cyber heist ever. Binance executives reportedly convened a roughly 100-person war room in the UAE at about 11 p.m. and watched funds leave over approximately 20 minutes: $1 billion, then $2 billion, eventually reaching $6.3 billion.

Binance worked with blockchain-tracing firms Chainalysis, TRM and Elliptic to identify the wallets receiving the money. Kessler explained that North Korean hackers typically begin laundering stolen cryptocurrency by splitting it across many wallets, creating a tracing nightmare. Platforms were sent lists of suspect addresses so they could freeze associated funds. Binance ultimately lost control of $6.3 billion but froze roughly half, leaving North Korea with about $3 billion to convert into spendable assets.

Kessler said the heist centered on two compromised engineers and North Korea’s use of social engineering rather than a simple external code exploit. One employee searched for the Homebrew software package and downloaded a malicious, unofficial version, apparently promoted through manipulated search results or an advertisement. Another Binance developer was contacted through what appeared to be a legitimate job-hunting forum, interviewed by people posing as a company, and persuaded to download malware for a coding assignment on a corporate laptop.

According to Binance, access from the compromised devices let the hackers use an internal AI platform and obtain wallet keys—or the ability to submit transactions—that made fraudulent transfers look like legitimate Binance withdrawals. They also exploited a new Ethereum feature introduced in 2025, taking advantage of its design rather than breaking into Ethereum itself. Kessler said investigators were still piecing together the technically sophisticated process; it was far more than stealing a password and clicking a button.

Binance said it had about $5 billion on its balance sheet to cover the stolen assets and traded another $1 billion into the specific assets needed, telling reporters that users had been made whole because the losses came from Binance’s accounts. Kessler said the exchange must now convince customers that it can protect funds in the future, especially because crypto platforms lack the disclosure and insurance requirements associated with U.S. banks. Bitcoin fell 4% to 5% in the first 24 hours, while scrutiny will focus on crypto’s use for laundering North Korean funds.