North Korea blamed for $6.3 billion crypto heist pulled off in just 20 minutes

Hackers drained approximately USD 6.3 billion from Binance in a 20-minute cyberattack. The breach triggered a market sell-off and an international race to recover the assets.A cyberattack lasting barely 20 minutes has turned into what analysts believe could be the largest financial theft in history, after hackers drained approximately USD 6.3 billion in cryptocurrency from Binance, which is the world's biggest crypto exchange. The attackers are suspected of having links to North Korea, whose state-backed hacking groups have repeatedly been accused of stealing digital assets to generate revenue.The scale and speed of the breach sent shockwaves through cryptocurrency markets on Friday, triggering a sell-off and forcing Binance to temporarily suspend withdrawals. The exchange has insisted that customer funds remain safe and pledged to cover the losses using its own reserves.But the money has not simply disappeared. Blockchain investigators, cryptocurrency companies and US law enforcement agencies are now racing to trace the stolen assets, freeze what they can and prevent the hackers from converting the remaining funds into usable money.Binance said it had located approximately USD 3 billion of the stolen assets, while stablecoin issuers have frozen another significant portion. The fate of the remaining funds, however, remains uncertain. So, how did the hackers pull off a multibillion-dollar theft in just 20 minutes, who is suspected of being behind it, and where has the stolen cryptocurrency gone?HOW DID THE USD 6.3 BILLION HEIST HAPPEN?The attack targeted Binance's digital infrastructure used to authorise and process cryptocurrency transactions. Unlike traditional banks, which maintain centralised accounts and payment systems, cryptocurrency exchanges rely on digital wallets to hold and transfer assets. These wallets are broadly divided into two categories: hot wallets, which remain connected to the internet for faster transactions, and cold wallets, which are kept offline for greater security.The hackers targeted a Binance-controlled hot wallet, exploiting weaknesses in the system responsible for approving transactions.According to US blockchain analytics firm TRM Labs, the attackers compromised Binance's signing infrastructure, the mechanism that authorises the movement of funds. This allowed them to issue instructions that emptied the affected wallets without passing through the exchange's normal approval safeguards."In layman's terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," Joshua Chu, a Hong Kong lawyer who works on crypto cases told news agency Reuters.The breach was not attributed to a single compromised device. Binance co-CEO Richard Teng described it as a "complex attack", involving a compromised laptop and malicious software designed to erase evidence of its activity.This made it harder for investigators to reconstruct what had happened and identify the entry points used by the attackers.The exchange initially suspected that a compromised laptop was responsible but later discovered additional points of breach. The actual theft unfolded with remarkable speed. Blockchain records examined by investigators show that the bulk of the funds was moved in roughly 20 minutes, beginning shortly after 2000 GMT on Thursday.Teng said the hackers managed to move the money without triggering the usual security checks."Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust," he wrote on X.WHY NORTH KOREA IS UNDER SUSPICIONSeveral blockchain intelligence companies have pointed towards North Korea, citing similarities between the Binance breach and previous cryptocurrency thefts attributed to the country's state-linked hacking groups.TRM Labs and Chainalysis said the attack shared characteristics with the 2025 theft from cryptocurrency exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korean hackers.TRM expressed high confidence that the same group was behind the Binance incident.North Korea has repeatedly been accused by US and South Korean authorities, as well as cybersecurity experts, of using state-linked cyber units to conduct espionage, steal financial assets and generate revenue for the country.Cryptocurrency exchanges have become particularly attractive targets because large sums can be transferred across borders without relying on conventional banking networks.The financial implications are also significant. North Korea has faced extensive international sanctions over its nuclear and missile programmes, making illicit financial operations an important concern for governments monitoring its activities."When North Korea steals at this scale, the money supports weapons proliferation, which makes this a national security issue, not just a crypto theft," said Ari Redbord, global head of policy and government affairs at TRM.WHERE HAS THE STOLEN MONEY GONE?Recovering cryptocurrency is not as straightforward as reversing a bank transfer. Once digital assets are moved between wallets, investigators must follow the transactions across the blockchain and identify ways to prevent the recipients from spending or converting them.That is where stablecoins have become important in the recovery effort.Stablecoins are cryptocurrencies designed to maintain a relatively stable value by being pegged to conventional currencies, usually the US dollar. Unlike Bitcoin and Ether, some major stablecoins are issued by private companies that retain the technical ability to freeze specific tokens.The feature has proved useful in the Binance investigation.Tether said it had frozen nearly USD 1.57 billion in assets linked to the incident, while Circle froze more than USD 800 million. Ripple and World Liberty Financial, the Trump family's cryptocurrency venture, have also been involved in freezing assets.Together, these actions have placed a substantial portion of the stolen funds beyond the hackers' immediate control. However, freezing cryptocurrency does not automatically mean it has been returned to Binance. It prevents the affected tokens from being transferred or spent through the issuer's system while investigations continue.The situation is more complicated for Bitcoin and Ether.Neither cryptocurrency has a central issuing company with the authority to freeze individual wallets. Once these assets are transferred to addresses controlled by hackers, they cannot simply be blocked by a company.Patrick Tan, general counsel of Singapore-based blockchain intelligence firm ChainArgos, explained that Bitcoin and Ether can only be stopped if the attackers send them to an exchange or broker willing to freeze the funds, or if law enforcement obtains the private keys controlling the wallets.TRM estimated that approximately USD 2.4 billion worth of Bitcoin and Ether remained beyond reach. Investigators also believe that the hackers may attempt to disguise the origin of the stolen assets by moving them repeatedly between different wallets, converting them into lesser-known cryptocurrencies or routing them through exchanges and brokers.Chainalysis said it had observed unusual laundering patterns involving thousands of transactions within a short period."Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence," the company said.But time is not necessarily on the hackers' side. As the stolen assets become identifiable and are flagged by exchanges and payment providers, converting them into usable money becomes increasingly difficult.Bernardo Brites, chief executive of stablecoin infrastructure company Trace Finance, said the first few hours after a cryptocurrency theft were particularly important for laundering the proceeds."The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers -- they essentially get blacklisted."FBI AND US SECRET SERVICE JOIN THE PROBEThe investigation has also drawn in US federal agencies, with Binance working alongside the FBI and the US Secret Service to trace the stolen cryptocurrency.The FBI confirmed that it was aware of the incident and was coordinating with public and private sector partners."The FBI said it was "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps."The Secret Service said its investigators were working with cryptocurrency companies to identify and recover the stolen assets.The USSS said in a statement that its investigators "are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace, and recover funds stolen from Binance on Thursday."Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, also said it was monitoring the situation and maintaining contact with the exchange.BINANCE PROMISES TO COVER LOSSES AS MARKETS SLIDEAs the investigation gathered pace, Binance moved to reassure customers that the breach would not affect their holdings. The exchange said it had set aside approximately USD 6.34 billion in company funds to cover the losses. It also has a separate USD 1 billion Bitcoin reserve, known as the Secure Asset Fund for Users, designed to protect customers in the event of security breaches.Co-CEO Yi He said the approximately USD 3 billion in assets located so far represented only about 2 per cent of the company's total user assets and public reserves.Binance said it expected to resume withdrawal services within 48 hours of the initial announcement, although the status of the remaining stolen funds remained unclear. The company's founder, Changpeng Zhao, also sought to reassure investors, saying on X that Binance owned SpaceX shares worth more than USD 1 billion.The exchange has 335 million registered users worldwide and held approximately USD 162.8 billion in assets under custody, according to its 2025 annual report.The scale of the breach nevertheless rattled cryptocurrency markets. Bitcoin fell to a six-week low of USD 76,368, while Ether dropped more than 3 per cent to a two-month low of USD 2,178 before recovering some ground.Binance's own BNB token also declined, falling 6.74 per cent over 24 hours to USD 698.The incident is now being viewed as more than another cryptocurrency security breach. Last year alone, attackers stole approximately USD 2.9 billion in digital assets across nearly 150 separate incidents, according to TRM Labs.- Ends