Hackers broke into investor accounts at Binance, the world's largest cryptocurrency exchange, on Thursday afternoon and withdrew more than $6.3 billion in digital assets in roughly 20 minutes, according to NPR. The attack, which began at 4:05 p.m. Eastern, is the largest crypto theft on record, and experts widely believe a hacking unit inside the North Korean military carried it out.
NPR reports that Binance has frozen about $3 billion of the stolen funds with help from other exchanges and partners, and that the company has said it will repay customers who lost money, though how it will do so remains unclear.
Why it matters
The scale of the loss has shaken the crypto industry and renewed doubts about a sector that critics have long described as the "Wild West" of finance. Ari Redbord, global head of policy at the crypto research firm TRM Labs, which has assisted Binance in tracing and recovering some of the funds, told NPR the episode amounts to "the largest bank robbery in human history." He described a scenario in which someone could enter a bank, leave with $6.36 billion, and move the money across the internet almost instantly.
The heist also sharpens a national security concern. Redbord said the perpetrators are not ordinary criminals chasing profit but professional military hackers whose proceeds fund weapons programs and other destabilizing activity.
What is known about the attack
Binance functions much like a stock exchange, except customers trade digital currencies such as Bitcoin rather than equities. Its users range from financial institutions and experienced traders to ordinary investors.
According to NPR, investigators have not established how the hackers gained entry to customer trading accounts, and researchers say it is too early to judge whether Binance's security systems had major weaknesses. What is clear is the speed and sophistication of the operation, which points to a North Korean military unit widely tracked as TraderTraitor. The same group is blamed for the previous record heist, the $1.5 billion theft from the exchange Bybit last year.
Redbord told NPR that North Korea has assembled the most advanced cyber capabilities in the world, with teams of full-time hackers embedded in its military. "This isn't just a commercial hacker who's looking to make some money," he said.
The regulatory gap under scrutiny
Critics of the industry argue the incident exposes structural problems rather than a one-off failure. Crypto exchanges let customers both trade digital assets and leave them on the platform for safekeeping, a combination that makes them attractive targets. Unlike Wall Street brokerages, they are not bound by the same strict rules.
Amanda Fischer, policy director and chief operating officer at the financial consumer advocacy group Better Markets, told NPR that investors on the New York Stock Exchange keep their money with a broker, not the exchange itself, and that broker is audited and regulated by the Securities and Exchange Commission and must carry insurance that makes customers whole after a cyberattack. Crypto investors enjoy no comparable protection, she said.
Because Binance's pledge to reimburse victims is not required under current rules, Fischer and other critics worry that smaller exchanges hit by similar attacks could lack the resources to make their customers whole, leaving traders to absorb the losses.
A pattern critics point to
Skeptics also warn that weak oversight can create dangerous incentives inside exchanges. Fischer pointed to FTX, which in 2022 ran into financial trouble during a period of severe market volatility and drew on customer funds in an attempt to save itself. The exchange collapsed, and its founder and chief executive, Sam Bankman-Fried, was sentenced to 25 years in prison on fraud and other charges.
Fischer said the temptation to tap client money when a trade sours can be hard to resist, and that doing so once can spiral into disaster for investors.
Binance's recovery effort and its promise of repayment now face scrutiny, and how much of the remaining $3.3 billion is traced and returned — and whether regulators respond to the gaps critics have identified — will be the measures to watch.
