Hackers who stole approximately $6.3 billion from cryptocurrency exchange Binance may have gained access to its systems through an employee's compromised laptop, with most of the money disappearing in just 20 minutes. The world's largest cryptocurrency exchange disclosed on Friday that its initial investigation pointed to a laptop belonging to a DevOps engineer, whose credentials may have allowed attackers to access internal systems and authorize fraudulent withdrawals.
However, Binance later revealed that investigators had discovered additional points of breach, suggesting the attack was more complex than initially believed. According to blockchain intelligence firm TRM Labs, the attackers began preparing at least 36 hours before the theft, testing their methods through smaller transactions before launching the operation on Thursday.
The hackers subsequently moved funds from Binance wallets across at least 10 blockchain networks, including Bitcoin, Ethereum, and Solana. Most of the estimated $6.3 billion was transferred within approximately 20 minutes, making it the largest cryptocurrency heist ever recorded.
Investigators have also linked the attack to North Korea's TraderTraitor hacking group, which was previously blamed for stealing $1.5 billion from crypto exchange Bybit in February 2025. However, Binance has not officially identified those responsible.
Meanwhile, the exchange said approximately $3 billion in affected assets had been frozen with assistance from other cryptocurrency companies. The remaining funds include cryptocurrencies that cannot be directly frozen by their issuers, complicating efforts to recover the money.
Binance has promised to cover all losses using its emergency protection fund and company resources, insisting that customer funds remain safe. The company said it had found no evidence that wallet private keys were leaked and would publish a detailed technical report once its investigation was complete.
Industry experts are now calling for a massive overhaul of cybersecurity protocols within centralized exchanges. The speed of the transaction suggests that the attackers had bypassed multi-factor authentication systems, raising concerns about the vulnerability of even the most secure platforms.
Regulatory bodies have also stepped in, with international financial watchdogs demanding a full audit of Binance's internal security measures. The incident has sent shockwaves through the global financial market, leading to a temporary dip in the value of major digital assets.
Binance's leadership remains under pressure to provide transparency regarding how such a massive breach occurred despite their claims of high-level security. The company has stated that it is cooperating fully with global law enforcement agencies to track the stolen assets.
As the investigation continues, the crypto community remains on high alert. This heist serves as a stark reminder of the persistent threats facing digital finance, highlighting the need for more robust, decentralized security solutions in the future.