Binance has disclosed a theft of roughly $6.3 billion in cryptocurrency, the largest such haul on record, and researchers have linked the operation to North Korea.
The entry path ran through people before it reached infrastructure. Attackers compromised several internal systems, starting with a Binance engineer’s laptop, then reached a privileged system with enough authority to authorize the withdrawals.
Blockchain analytics firms working with the exchange have frozen about $3 billion on-chain so far. Binance said it will absorb the remaining losses itself and has suspended deposits and withdrawals while the investigation runs.
Both the FBI and the U.S. Secret Service confirmed involvement. The Bureau said it was coordinating with public and private partners to establish scope and impact, while a Secret Service spokesperson in Washington described investigators working continuously with counterparts.
The scale invites comparison with past exchange failures, but the mechanism differs from the smart-contract exploits that dominated earlier losses. Nothing was broken in the protocol. A privileged human path was walked from an endpoint inward.
That pattern is familiar from North Korean campaigns, which have leaned for years on developer and employee targeting to reach signing keys and treasury access rather than attacking chains directly. The pivot from workstation to privileged system is the step that turned a single credential compromise into a nine-figure-scale extraction.
For custodians elsewhere, the lessons are structural. Laptop compromise is an expected event, so the controls that matter are the ones between an engineer’s device and anything that can move funds: hardware-backed approval, quorum requirements for large transfers, and rate or velocity limits on outbound treasury operations.
Attribution also brings sanctions and law-enforcement exposure into play, which historically has helped recovery efforts even when the underlying funds have already been layered through mixers.
