A 20-Minute Binance Hack, $6.3 Billion Stolen, and the Timeline of the Biggest Crypto Theft on Record

A fast-moving attack drained Binance wallets across ten blockchains in roughly 20 minutes on Thursday afternoon in Argentina. Reuters said the hackers took $6.3 billion, in an incident analysts link to North Korea and one that could end up as the largest financial theft ever.

1. Binance had already warned the market. On Tuesday, the exchange said it had blocked multiple cyberattack attempts linked to North Korean actors during the previous week, with no asset losses reported at the time.
2. According to TRM Labs, the attacker’s operational wallet received three small withdrawals from Tornado Cash about 36 hours before the theft. That pattern matches earlier attacks attributed to North Korea, including Bybit and KelpDAO.
3. The drain started on Thursday at about 17:00 Argentina time. Five Binance wallets on XRP Ledger sent 233 million XRP to the attacker’s address. At 20:20, Bitcoin followed with 18,270 BTC, along with Ethereum, where the attacker used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a controlled “sweeper.”
4. Issuers started freezing funds within minutes. Tether froze assets at 21:01, Circle at 21:04, Ripple at 22:01, and World Liberty Financial at 22:10. Reuters said Tether froze nearly $1.570 billion and Circle more than $800 million.
5. The public announcement came later that night. Bloomberg reported that Binance suspended withdrawals and said it would cover the losses, with about $3.000 billion frozen according to a company post on X. Bloomberg Línea had earlier reported that Binance would cover all losses and that the frozen amount was then $2.540 billion. Changpeng Zhao, Binance cofounder and former CEO, wrote on X that “it does seem to be a hack.”

The scale is the part that matters for PSPs and acquirers. TRM Labs put the haul at roughly four times the February 2025 Bybit hack, which had been the record at $1.500 billion. Elliptic went further, saying the incident is almost certainly the largest known theft of any kind. Binance says customer funds are safe and that it will absorb the losses; the market now watches whether it can trace the missing assets and how long withdrawals stay closed.