Skip to content
NewSQL, Python and Power BI training for your team
Log in

20 Minutes, $6.3bn: Inside the Biggest Crypto Heist Ever

North Korean hackers drained Binance in about 20 minutes. Here is how it happened, and what Nigerian crypto users should learn.

Muhammad Jamilu Abdullahi 9 min read
Cream cover reading $6.3bn in 20 minutes, beside a stopwatch with a third of its dial in amber and coins flying out

At 9:05pm Nigerian time on Thursday 29 October, five Binance wallets on the XRP Ledger began to empty. In four minutes, 233 million XRP had gone.

A quarter of an hour later, a Binance bitcoin wallet sent out 18,270 bitcoin in a single transfer. Around the same moment, the exchange's main Ethereum hot wallet was swept clean, including about 1.6 billion USDT, a stablecoin pegged to the US dollar.

Most of roughly $6.3bn left the world's largest crypto exchange in about 20 minutes. Blockchain analysts call it the biggest crypto theft on record. The tracing firm Elliptic goes further: it says this is almost certainly the largest known theft of any kind.

On Saturday 31 October, the FBI named the thief: TraderTraitor, a North Korean state hacking unit.

What happened

At first, Binance blamed one compromised laptop belonging to a DevOps engineer. That device, it said, let the attacker into an internal system that could submit withdrawals. A day later, the picture grew. Binance found more points of entry, and co-CEO Richard Teng wrote that "the attacker did not simply use one engineer's permissions". He said the attacker's tools were designed to wipe their own traces as they ran.

TRM Labs, which tracked the money as it moved, says the attack was prepared at least 36 hours ahead. The attacker funded a fresh wallet through Tornado Cash, a coin-mixing service. It then tested its code on two wallets and rehearsed on a third.

On Ethereum, the attacker abused a 2025 upgrade called EIP-7702 to make a Binance hot wallet run the attacker's own code. On the other nine blockchains, Binance's systems simply signed the transfers. TRM's reading is that the attacker had taken control of Binance's hot-wallet signing set-up. There is no sign the underlying cryptography was cracked, and Binance says it found no evidence that private keys leaked. TRM attributes the theft to North Korea "with high confidence". Pyongyang denies using state cyber units to steal, Reuters reports.

When (UTC)What happened
28 Oct, morningAttacker's wallet funded through small Tornado Cash withdrawals
29 Oct, daytimeAttack code tested on two wallets, then rehearsed on a third
29 Oct, 20:05Outflows begin from XRP Ledger wallets
29 Oct, 20:20–20:24Bitcoin, Tron and main Ethereum hot wallets drained
29 Oct, 21:01–21:04Tether freezes 971m USDT; Circle freezes 823m USDC
30 OctBinance puts the impact at about $6.3bn, with about $3bn frozen
31 OctFBI names TraderTraitor; Binance says 90% of losses covered
1 NovFirst withdrawals reopen, starting with bitcoin; Binance says 95% replaced

Bitcoin fell almost 5% to below $77,000, a six-week low. BNB, Binance's own token, dropped about 8%.

The till, the vault and the manager's stamp

Picture a busy supermarket in Kano or Lagos. The cash drawer at the counter holds enough for the day's change. Most of the money sits in the bank vault.

Crypto exchanges work the same way. A hot wallet is the till. It stays connected to the internet so customer withdrawals go out quickly. A cold wallet is the vault. It is kept offline and is much harder to reach. Teng says most Binance customer assets sit in cold wallets and only move to hot wallets when someone withdraws.

Every crypto transfer also needs a digital signature made with a secret signing key. Think of it as the manager's stamp on a payment voucher. Thieves usually try to steal the stamp. This time, they appear to have got into the back office and made Binance's own approval system stamp their withdrawals for them.

Then came the race to freeze the money. Stablecoins such as USDT and USDC are issued by companies, Tether and Circle, that can lock coins at a known address. It is the crypto version of a bank placing a Post No Debit order on an account. Both firms froze coins within about an hour.

Bitcoin and ether have no issuer to call. The attacker dumped stablecoins for ether at a loss of more than 10%, just to get out of reach. Then it began scattering funds across thousands of addresses. It is like breaking one big bundle of naira into small notes and handing them to hundreds of runners.

Why it matters

The scale. $6.3bn is about four times the previous record, the $1.5bn stolen from Bybit in February 2025. The FBI blamed the same North Korean group for that one too. In the whole of 2025, hackers stole $2.9bn across nearly 150 attacks, according to TRM.

The pattern. TRM estimates North Korea has stolen about $12.8bn in crypto since 2017, with $7.4bn of it in 2026 alone. That is 85% of all crypto hack value worldwide this year. Researchers say the money helps fund the country's sanctioned weapons programmes.

The method. Nothing in bitcoin or Ethereum was broken. The weak points were a laptop, internal systems and approval rules. For anyone who builds or runs software, that is the real lesson. People and processes usually fail long before the maths does.

The other side

Binance moved fast. It set aside more than $6.34bn of company money, drawn from its $1bn emergency fund (known as SAFU), its futures insurance fund and its treasury. By 1 November it said it had replaced about 95% of the stolen assets. About $3bn has been traced and frozen with partners. Co-founder Yi He promised Binance would cover "all hacking losses".

Binance reported $162.8bn in assets under custody in its 2025 annual report, so the loss is roughly 4% of that. Big trading firms Wintermute and GSR disclosed exposure but said they did not expect major disruption.

But a promise is not a guarantee. Exchanges hold customers' coins much like brokers do. Yet, as the US group Better Markets points out, they are not required to carry the insurance that securities brokers must have. Binance has not yet published a root cause. Kok Tin Gan of the security firm NyxLab asked why stronger approval controls were not in place.

And few firms could write a $6bn cheque in three days. In 2014, Mt Gox, then the world's biggest bitcoin exchange, filed for bankruptcy after losing about 750,000 customer bitcoins, which it blamed on hackers. It left 127,000 creditors.

What it means for Nigeria and Africa

Nigeria is one of crypto's busiest markets. Chainalysis's 2026 Global Crypto Adoption Index ranks it third in the world, and first for both peer-to-peer trading and cross-border flows. Sub-Saharan Africa led the world in growth.

Binance's history here is rocky. In February 2024, Nigeria restricted access to its website and detained its executive Tigran Gambaryan. He spent about eight months in custody, much of it in Kuje prison, before being freed on humanitarian grounds in October 2024. Binance ended its naira services in March 2024. Many traders moved to rivals, and TechCabal reported that Bybit became the favourite. Bybit went on to suffer the previous record hack.

The legal dispute is not over. Binance faces a four-count tax evasion charge in Abuja. In July the case was adjourned to 24 September while both sides explored a settlement. The tax authority is also pursuing a separate $79.5bn claim over alleged economic losses.

Meanwhile, the rules have changed. The Investments and Securities Act 2025 treats digital assets as securities and places exchanges under the Securities and Exchange Commission (SEC). On the very day of the hack, the SEC said: "No digital asset operator yet holds a final registration with the Commission." Fourteen firms sit in its incubation scheme, and Busha and Quidax received approval in principle in 2024. Binance is not on the SEC's list.

For Nigerian users, the takeaway is sobering. A foreign exchange outside local oversight offers little local recourse if things go wrong. And few smaller platforms could absorb a loss like this.

What to do now

  1. Don't keep everything in one place. Leave only what you actively trade on any exchange. Spread the rest so one failure cannot wipe you out.
  2. Learn self-custody before you need it. A hardware wallet keeps your keys offline, like your own small vault. But if you lose the recovery phrase, nobody can restore your coins, so store it carefully and never share it.
  3. Upgrade your two-step login. Use an authenticator app, passkey or hardware security key instead of SMS codes. Switch on withdrawal address allowlists and anti-phishing codes where offered.
  4. Treat every "recovery agent" as a scammer. As of 30 October, Binance had announced no claims form, so "refund" links are fake. The FBI warns that recovery fraudsters demand fees upfront, and real investigators never charge victims.
  5. Check who regulates your platform. Look up the SEC's published list of approved operators. Remember that an approval in principle is not a final licence.
  6. Read proof of reserves with care. It is a snapshot showing an exchange holds at least what it owes customers; Binance took a new one on 31 October. Check your balance is included, and remember it shows one moment, not the future.
  7. Watch the post-mortem. Look out for Binance's root-cause report, the reopening of remaining withdrawals and where the laundered money surfaces next.

The biggest theft in history did not break the blockchain. It broke a laptop and a set of approvals. Whether you hold crypto or simply run a business on computers, that is the part worth remembering.

Sources

Keep reading

All posts