North Korea Just Pulled Off the Biggest Crypto Heist in History, Draining $6.4 Billion From Binance in 20 Minutes
A hacked laptop belonging to one engineer opened a door that drained billions from Binance across ten blockchains in under half an hour, and the group behind it has done this before.
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
At 20:05 UTC on October 29, just after the US stock market closed, an attacker began emptying Binance wallets across ten blockchains. Most of the money left in about 20 minutes.
Blockchain analytics firm TRM Labs counts $6.36 billion taken and calls it the largest crypto theft on record. The firm attributes it to North Korea’s TraderTraitor unit: “We make this judgment with high confidence.”
Binance estimates $6.3 billion, and another firm puts the total near $5.9 billion. Binance has not confirmed who did it. The theft is about four times the size of the $1.5 billion Bybit hack of February 2025. The FBI tied that hack to the same group.
Coinbase (NASDAQ:COIN | COIN Price Prediction) closed at $160.59, down 1.07%, then fell 4.82% to $152.85 after hours. That drop combines the hack with a third-quarter earnings report released the same afternoon, so it does not measure the hack alone.
A Compromised Laptop Gave Attackers Access
Early findings point to a hacked laptop belonging to a DevOps engineer (a staff member who runs internal systems), which let the attacker reach an internal service and send unauthorized withdrawals. Binance said, “We have found no evidence of any wallet private key leak.”
That makes this a custody and internal-process failure, a risk every centralized exchange carries.
Binance says SAFU, an emergency fund it keeps to protect users, plus company funds will cover all losses. The theft equals about 4% of the $144 billion it held before the hack, but withdrawals stay paused until a security scan ends.
Freezes Caught Part of the Money
Several firms and councils acted within hours. Tether, Circle (NYSE:CRCL), Ripple, World Liberty Financial and the Arbitrum Security Council froze about $2.7 billion, including over $800 million frozen by Circle. A freeze stops the money from moving but does not return it. The attacker still held 18,270 units of Bitcoin (CRYPTO:BTC). They also held more than 420,000 units of Ethereum (CRYPTO:ETH), about $2.4 billion that no issuer can freeze.
North Korean groups usually launder stolen funds through mixers and bridges, so sales from that stash could keep pushing prices down. Bitcoin traded at $78,457 early on October 30, down 1.77% over 24 hours.
More than $1.5 billion of borrowed-money positions, mostly positions that profit from rising prices, were liquidated over 24 hours. A liquidation is a forced sale that happens when a trader’s collateral falls too far.
Coinbase Wins Trust but Depends on Volume
A record theft at an offshore exchange strengthens Coinbase’s case on licensing and custody. Its share of trading volume reached 10.7% in the third quarter. Even so, third-quarter revenue of $1.22 billion fell 35% from a year earlier, and operating income dropped 87%.
Coinbase earns the most when prices rise and trading is busy, so a hack that drives prices lower can cost it more in lost volume than it gains in market share.
Robinhood (NASDAQ:HOOD) closed up 0.17% at $91.59 and fell 4.59% after hours. Circle fell 5.65% to $75.47 after hours. Neither company reported earnings that day, so those drops show the hack dragged the whole group down.
What Coinbase Shareholders Need to Track Next
Coinbase faces mounting pressure. The stock is down 28.99% year to date and 53.93% over one year, and the hack threatens the trading activity that drives its revenue.
Washington will likely push for tighter rules on exchanges and money laundering, and those rules would favor compliant US platforms. That benefit would take years to arrive, while the stolen crypto that remains unfrozen is a risk right now.
Robinhood has more diversified exposure because its brokerage earns revenue from stocks and options as well as crypto. Circle showed regulators it can act quickly, although the same freezes remind holders that its stablecoin can be frozen.
Investors will want to see Binance reopen withdrawals smoothly. If withdrawals resume and Coinbase still cannot get back above its October 29 close, the market expects lasting damage.
Contact [email protected] for any questions or corrections.
Omor Ibne Ehsan is a writer at 24/7 Wall St. He is a self-taught investor with a focus on growth, cyclical, and dividend equities that have strong fundamentals, value, and long-term potential. He also has an interest in high-risk, high-reward investments such as penny stocks.
