Crypto Was Supposed to Be Unhackable. So How Did North Korea Just Steal $6 Billion in 20 Minutes?

3 min readOn Thursday, Binance—the world’s largest cryptocurrency exchange—got to add another “world’s largest” accolade to its name by becoming the target of the biggest cryptocurrency heist in the industry’s history. According to the company, more than $6 billion in digital coins were stolen from users’ digital wallets. Binance has already announced that it’s restored some of the lost funds to affected accounts.Although the details of the hack are still a bit fuzzy, TRM Labs, a crypto research company, says the money moved out of 10 blockchains within 20 minutes and attributes the attack to TraderTraitor, a hacking unit associated with North Korea. In February last year, the FBI traced a $1.5 billion hack of the crypto exchange Bybit to the same group. A smaller hack this April was also linked to the broader North Korean–run Lazarus Group.In Thursday’s hack, TRM Labs reports that no specific cryptocurrency was safe, as digital coins were stolen from wallets containing Ethereum, Bitcoin, Tron, Solana, and six others. The balances were sent to an account operated by the attacker. After news of the hack, Bitcoin's price dropped a few percentage points, though it stayed above its low from this past summer.“Our teams are working around the clock to resolve this issue safely and thoroughly,” Binance said in a post on X. “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.”One of the purported benefits of the blockchain is its inherent security, mostly due to its decentralized nature, along with its strong cryptographic protocols. However, crypto exchanges are much more vulnerable than blockchain itself because they’re essentially a centralized holder of assets. They’re also prone to technical vulnerabilities, not least of which can be simple human error. In that same statement on X, Binance announced that its initial investigation found that a “compromised DevOps engineer’s laptop” may have allowed hackers to gain access to a service container—which they then used to make the withdrawals. However, Binance followed up that statement hours later, suggesting that the laptop may only be one vulnerability and that there were “additional points of breach.”North Korea has targeted cryptocurrency exchanges since at least 2017, according to The Guardian, drawn by “the sector’s relatively lax security controls” and relatively weak regulatory oversight. Binance has faced its own regulatory problems. In 2023, founder Changpeng Zhao pleaded guilty to violating the U.S. Bank Secrecy Act by failing to maintain an effective anti-money-laundering program, and the company agreed to pay more than $4 billion in penalties. President Donald Trump pardoned Zhao in October 2025.As for North Korea, when it comes to crypto hacking—business is booming. A United Nations (UN) panel concluded in 2024 that these types of hacks accounted for roughly half of the reclusive country’s foreign currency income, and were a significant fundraiser for the country’s nuclear weapons program. Due to the decentralized, pseudonymous nature of cryptocurrencies, these funds also bypass international sanctions meant to rein in Pyongyang’s most bellicose impulses.Now, it appears that North Korea has scored its biggest windfall yet.Darren lives in Portland, has a cat, and writes/edits about sci-fi and how our world works. You can find his previous stuff at Gizmodo and Paste if you look hard enough.