The biggest heist in crypto history unfolded in mere 20 minutes

HACKERS stole US$6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record digital asset theft by draining wallets it uses to process transactions.

Binance said in a statement on X it initially thought the attack involved a compromised laptop.

"However, our subsequent investigation has uncovered additional points of breach," it added, without elaborating.

The exchange operates a secure asset fund for users, a US$1 billion Bitcoin reserve designed to protect customers in the event of a security breach, according to its website.

Co-chief executive officer (CEO) Richard Teng said losses would be covered by the fund and company resources.

According to United States blockchain analytics firm TRM Labs, the attackers compromised Binance's "signing infrastructure", which authorises transactions, allowing them to issue instructions that emptied the affected wallets.

The bulk of the Thursday heist unfolded in about 20 minutes, blockchain records show.

Once the funds were moved, the attackers raced to shift them beyond the reach of Binance counterparties and stablecoin issuers, which have frozen roughly half of the stolen assets.

An unusual feature of some cryptocurrencies, including major stablecoins such as Tether's USDT and Circle's USDC, is that their issuers can freeze them remotely.

"In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," said Joshua Chu, a Hong Kong lawyer who works on crypto cases.

Several US analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers.

Teng said Binance's probe had not yet identified the attackers, while North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts.

On Saturday, the US Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft.

TRM said the breach shared characteristics with last year's attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers.

The firm said it was highly confident the same group was behind the Binance theft.

Chainalysis said funds stolen in an attack last month on Bitget were being mixed with proceeds from the Binance breach.

About half the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture.

That doesn't mean the coins will be returned to Binance, but it significantly limits the attackers' ability to convert them into cash.

TRM said some of the funds had already been posted as collateral to borrow ether and estimated that about US$2.4 billion worth of Bitcoin and ether is beyond reach.

Because no centralised entity issues Bitcoin or ether, no one can freeze those assets, said Patrick Tan, general counsel of ChainArgos, a blockchain intelligence firm in Singapore.

"The Bitcoin and ether can be stopped only if the attacker sends them to a crypto-asset exchange or broker that is able and willing to freeze them, or if law enforcement obtains the private keys."

Market participants and analysts said the attackers would likely mix the stolen coins with other assets or use lesser-known coins and exchanges to try to move the proceeds.

Bernardo Brites, CEO of Trace Finance, a stablecoin infrastructure company, said typically the proceeds of such hacks can only be laundered in the first few hours.

"The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers — they essentially get blacklisted."

Chainalysis said in a post on its website its investigators were observing laundering patterns they had not seen before.

"Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.

"Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence," it wrote.

The theft is the latest in a series of major digital asset breaches.

Attackers stole US$2.9 billion of cryptocurrency across nearly 150 incidents last year, according to TRM Labs.