David Yaffe-Bellany & Dustin Volz
In February 2025, a team of North Korean hackers stole $1.5 billion from the cryptocurrency exchange Bybit — a dark day for the industry and the largest crypto heist ever recorded.
Now that number looks paltry.
Binance, the world’s biggest crypto exchange, set an unwanted record Thursday, losing $6.3 billion to hackers in an eye-popping attack that highlighted the deep vulnerabilities in crypto’s financial infrastructure.
For years, the industry has struggled to prevent thefts. Now, the risks are becoming even more extreme as attackers use artificial intelligence and other advanced techniques to steal funds and launder them quickly, crypto analysts and security experts said.
The Binance attacker used “laundering patterns we have not seen before,” the crypto analytics firm Chainalysis wrote in a blog post Friday. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
The details of how Binance was breached are still coming into focus. Both Chainalysis and TRM Labs, another analytics firm, attributed the hack to North Korea, which has targeted crypto companies for years. Binance initially said the attacker appeared to have compromised a laptop belonging to one of its engineers, before clarifying that further investigation had uncovered “additional points of breach.”
Binance has promised to make customers whole and said it had set aside more than $6.3 billion in company funds to cover the losses. (Binance processes billions of dollars in transactions every day.) Of the total that was stolen, $3 billion has been frozen by other companies, including Circle and Tether, two large issuers of digital coins that can stop the movement of stolen funds.
That means North Korea won’t have access to those coins, and Binance said it was working on recovering them. But the hackers have already moved $2.4 billion in crypto “beyond any issuer’s reach,” according to TRM.
Those losses may be only the beginning, as the crypto world reckons with an era of fast-evolving hacking techniques and growing risks. Even as President Donald Trump has endorsed the industry and sought to bring it into the mainstream, some crypto firms still struggle with the basic work of any financial company — keeping customer money safe.
“AI is undoubtedly turbocharging the ability of hackers to find and exploit subtle flaws in various parts of the crypto ecosystem,” said Eswar Prasad, a Cornell University economics professor who tracks the crypto industry. “The scale and scope of such attacks is likely to intensify.”
Asked Friday whether the US believed North Korea was responsible for the Binance hack, Trump demurred.
”We don’t know,” he said. “We’re looking at that.” Appearing to then reference cryptocurrencies generally, Trump said, “People never see the money anymore. I’ve always felt it was a little bit dangerous. But they say they have it pretty much under control. We’ll see.”
Crypto has struggled with major thefts since the technology’s inception in 2008. Industry pioneers viewed digital coins as a renegade alternative to banks — a type of money outside the supervision of governments or big businesses. From the beginning, that philosophy made crypto vulnerable.
Many crypto investors keep funds in their own online wallets. But if they lose a password, the money is gone forever. Others rely on exchanges like Binance, which behave something like banks, storing funds for customers. But exchanges are not subject to the same regulatory systems that govern banks and other traditional financial companies, and have often lacked effective guardrails against crime.
In February 2025, North Korean hackers tricked the CEO of Bybit, Ben Zhou, into authorising a seemingly routine transaction that handed them control of the exchange’s system. They had exploited a gaping hole in Bybit’s defences — a free software product that the company used to protect customer deposits. The thieves extracted $1.5 billion in digital coins.
At the time, a security firm called the losses “completely preventable.” Ultimately, Bybit weathered the crisis by drawing on corporate reserves and borrowing funds from other crypto companies.
The attack on Binance appears more serious.
After it was founded in 2017, the exchange quickly became the largest and most important company in the crypto industry, processing as much as two-thirds of all digital currency transactions. It provides a marketplace for people to buy popular coins such as Bitcoin and Ether, converting traditional currencies into crypto.
On Thursday, as soon as Binance’s system was breached, its founder, Changpeng Zhao, assured customers that they would not lose any money.
“It hurts, but we will survive,” he wrote on the social platform X, adding a muscle emoji.
Zhao has a long history of legal and regulatory problems. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the US government. After serving a four-month prison sentence, Zhao was pardoned by Trump last year. Binance also forged a business relationship with World Liberty Financial, the Trump family’s crypto company.
News of the Binance hack started to spread on social media Thursday afternoon. Because most crypto transactions are publicly visible, industry analysts tracked sudden withdrawals from the exchange on the blockchain. But while transactions happen openly, the money often moves too quickly for companies to respond, and it can be difficult to determine who controls particular accounts.
Chainalysis attributed the attack to North Korea, in part, because it observed stolen Binance funds “commingling” with funds stolen last month in a hack targeting Bitget, another crypto exchange. In its analysis, TRM said the Binance hack was the work of TraderTraitor, North Korea’s elite hacking unit.
In a statement, the FBI said it was “aware of the incident” and “engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps.”