Attackers drained about $6.3 billion from Binance hot wallets across several blockchains late Thursday, most of it in a burst lasting about 20 minutes, CoinDesk reported. It is the largest crypto theft on record. Binance paused withdrawals and estimated they could resume in about 45 to 48 hours.
Binance's own disclosures have shifted. It first pointed to a compromised DevOps engineer's laptop, which let attackers submit unauthorized withdrawal requests, then said it had found additional exploit points without giving details. It says it has seen no evidence that wallet private keys were stolen. Chainalysis and TRM Labs linked the attack to North Korea with high confidence. Binance has not confirmed that.
The count differs too. Elliptic puts the theft at $6.43 billion, per Yahoo Finance.
Binance says it has set aside more than $6.34 billion and will restore balances one for one, with about $5 billion already held in the affected tokens and the rest being bought. Partners have frozen about $3 billion of the stolen assets. Tether accounts for nearly $1.57 billion of that and Circle for more than $800 million.
Those freezes worked because the tokens have issuers who can freeze them. Bitcoin and ether do not.
Bottom Line
A 20-minute drain means the withdrawal controls failed, whatever the entry point was. Treat any exchange balance as an unsecured claim on that exchange's internal systems, and keep on it only what you need to trade. Check Binance's promised proof of reserves when withdrawals reopen.