North Korean hackers allegedly steal $6.3 billion from Binance in a 20-minute raid

Binance says customer assets are unaffected after an attack that, according to Reuters and blockchain firms TRM Labs and Chainalysis, moved $6.3 billion out of the exchange’s wallets in about 20 minutes. For PSPs, exchanges, and anyone underwriting high-risk flows, the important part is not just the size of the theft but the speed: once signing access is compromised, funds can be pushed through before anyone has time to ask questions.

1. The attack began at 4:05 p.m. on the 29th Eastern time (5:05 a.m. on the 30th Korea time) and, according to the reports cited, the theft was completed within 20 minutes. Binance Holdings Ltd., the world’s largest virtual asset exchange, was the target.
2. Investigators said the attackers first compromised the laptop of a Binance development and operations engineer to obtain signing authority for transactions. They then used privileges that could bypass normal approval procedures to drain assets from 10 of Binance’s Blockchain wallets.
3. Between 4:05 and 4:09, the attackers moved 233.46 million XRP to their own account. At 4:10, they hit the Solana and Optimism wallets. At 4:20, they stole 18,270 bitcoins, and two minutes later they withdrew 612.7 million Tether (USDT) without authorization.
4. After the initial drain, the attackers rushed to convert $325 million into 122,300 Ether once they had stablecoins that could be frozen. The reported logic is straightforward: stablecoin issuers can remotely freeze assets in specific wallets, while Ether is harder to freeze directly. The exchange took place at $2,650 per coin, even though Ether was trading around $2,300 to $2,350 at the time, which suggests speed mattered more than price.
5. The hackers also borrowed 19,760 Ether using $6,000 worth of stablecoins as collateral. About 10 minutes later, they tried to transfer the remaining $175 million worth of stablecoins to the criminal account, but the virtual asset industry had already started freezing measures at 5:14 p.m.

The laundering pattern matters for anyone watching high-risk fraud and sanctions exposure. The group reportedly used circular transfers across multiple wallets to break tracing, sent test amounts before moving larger sums, and ended up mixing funds from this Binance incident with funds from the Bitget hack the previous month. Industry sources are pointing to North Korea’s elite hacking group TraderTraitor as the culprit. Binance says there is no problem with customer assets.