The $6.3 billion Binance hack: What we know so far about the biggest crypto heist in history [Updated]

The crypto world is reeling after a hacker drained billions of dollars from Binance, the world’s largest digital currency exchange, on Thursday. The full details of the hack are still emerging, but the broad strokes of what happened are becoming clearer, as everyone from security researchers to Elon Musk to the company itself weigh in on the incident, which was almost certainly carried out by North Korea. (This story was updated on October 30 at 4:30pm ET with additional information).

Binance posted on X late Thursday evening Eastern Time, stating that a compromised developer laptop is partly to blame for the catastrophe, which is by far the biggest security incident in an industry that has been plagued by hacking since its earliest days. The company plans to provide more extensive details, and in the meantime, many other big crypto firms—including its biggest rivals—have rushed in to aid Binance. Here is a detailed look at what we know so far about the nature and scope of the hack, and what is likely to happen next.

Reports of a hack began surfacing on X early on Thursday afternoon. That’s when crypto observers, referring to public blockchain data, pointed to large amounts of currency moving out of wallets associated with Binance. Soon after, company cofounder Changpeng Zhao confirmed the hack.

In its post on Thursday evening, Binance stated the hacker appeared to have gained control of a laptop belonging to an employee or a contractor. The company wrote that the “initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Since that posting, crypto and security researchers have noted that the hackers essentially hijacked internal Binance wallets in order to “sweep” the funds to external wallets they controlled. They did this by using features of the Ethereum protocol that also let them help cover their tracks and lock out Binance security teams.

Mid-day Friday, Binance co-CEO Richard Teng provided an additional update saying the attack was more pervasive than one laptop. He wrote: “This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.

This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.”

Reports on X have suggested the hacker made off with anywhere from $2 billion to $8 billion, but in its post, Binance said the estimated total impact sits at around $6.3 billion. The situation is still fluid, and it could be days before the scope of the hack is finally determined.

Early reports say the hacker took $1.5 billion in Bitcoin and around the same amount in the stablecoin Tether, and slightly under a billion dollars worth of Ethereum and the USDC stablecoin. It is likely the hacker stole various other currencies, too.

No one has claimed responsibility for the hack, and Binance has not pointed to a specific culprit, but security firms TRM and Chainalysis have both said North Korea is almost certainly behind it.

This theory is highly plausible given that the North Korean military has long used crypto hacking to help fund its operations. The sophisticated nature of the hack, which included efforts to move the funds after they were stolen, is also consistent with the tactics of North Korea. For now, though, there is no definitive proof the country is responsible.

Soon after news of the hack became public, Tether and Circle—the firms responsible for minting USDT and USDC, respectively—announced they would freeze any stablecoins tied to the hack.