How did North Korean hackers carry out the $6.3 billion Binance crypto heist?

Highlights:

One of the world's largest cryptocurrency exchanges, Binance is facing a major test of customer confidence after users withdrew approximately $3.6 billion in cryptocurrency assets following what has been described as the largest theft in the exchange's history. The massive outflow came after the company restored withdrawals on November 1, three days after a reported $6.3 billion theft linked to North Korea.

The incident triggered an immediate suspension of transactions as Binance moved to contain the damage. However, when the exchange reopened withdrawals, customers rushed to move their funds, raising questions about the security of their assets and the platform's ability to protect them.

According to media reports, the exchange recorded withdrawals of approximately $4.649 billion in assets against deposits of $1.01 billion, resulting in a net outflow of around $3.64 billion.

A withdrawal rush after Binance reopens

Binance announced on X that it had started restoring withdrawals in phases at 06:00 UTC on November 1.

"By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase," the company said.

The exchange acknowledged an initial spike in withdrawal activity but said volumes had subsequently declined and were stabilising. Deposit volumes, meanwhile, remained substantial.

The $3.64 billion net outflow represented approximately 2.1 per cent of Binance's total assets under management, which stood at $171 billion, according to the company.

Binance said it was continuing to test the remaining networks and assets before restoring full access.

"Our team continues testing rigorously the remaining networks and assets. We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can. Rest assured that market conditions are stable," the exchange said.

North Korea suspected in record-breaking crypto theft

The theft has drawn attention to the growing cybersecurity threats facing cryptocurrency platforms.

According to The New York Times, cybersecurity analysts and the FBI have attributed the attack to North Korea, which has repeatedly targeted cryptocurrency companies to steal digital assets.

The country's suspected hacking operations have reportedly exploited vulnerabilities in cryptocurrency infrastructure, making exchanges and other digital asset businesses potential targets.

The scale of the latest incident has also raised questions about the methods used by the attackers.

According to the newspaper, cybersecurity firm Chainalysis suggested that artificial intelligence may have helped accelerate the attack. The firm noted that the attackers processed "thousands of transactions in a short period".

However, the precise role of AI in the theft has not been independently established in the information released so far.

Binance promises to cover losses and freeze stolen assets

In response to the incident, Binance said it would cover all losses resulting from the hack, seeking to reassure customers concerned about the safety of their funds.

The company has also worked with other cryptocurrency businesses to freeze approximately $3 billion in stolen assets, according to The New York Times.

The recovery effort could prove important in limiting the financial damage and preventing the stolen cryptocurrency from being moved or converted.

Changpeng Zhao, a co-founder of Binance, also addressed the importance of customer confidence during the crisis.

"Trust isn't earned by what you say in good times. It's earned by what you do in hard times," he said.

Zhao also warned customers to remain cautious of online scammers offering fake compensation or claiming to help victims recover their funds.

Can Binance win back customer confidence?

Although Binance says withdrawal activity is stabilising and market conditions remain steady, the incident has placed the exchange under considerable scrutiny.

The $3.6 billion outflow highlights how quickly customers can move their assets when confidence in a cryptocurrency platform is shaken.

For Binance, restoring access to funds is only part of the challenge. Demonstrating that its systems are secure, addressing the losses and preventing similar incidents will be crucial to rebuilding customer trust.

The episode also serves as a reminder of the cybersecurity risks facing the wider cryptocurrency industry, where a single major breach can trigger billions of dollars in withdrawals within hours.