How big a deal is the $6.3bn crypto heist, who did it, and are investments safe?

The world’s largest cryptocurrency exchange has been hit by a $6.3bn heist that, according to experts, is likely to be the work of North Korea.This is not the first time a crypto market has been targeted by hackers, and the rogue state has a track record of this type of theft. Here we answer some key questions about what’s happened:Just how big a deal is this?It could be the biggest heist of any kind in history, according to Elliptic, a consultancy specialising in crypto-related crime. It is more than four times bigger than the previous largest crypto hack, the $1.5bn one targeting the Bybit exchange last year, and Elliptic says there does not appear to be anything comparable in the pre-crypto era.“This incident is almost certainly the single largest known theft of any kind,” says Tom Robinson, the consultancy’s chief scientist. “Before Bybit, that record was held by Saddam Hussein, who took $1bn from the Central Bank of Iraq in Baghdad on the eve of the 2003 Iraq War. The Binance theft is more than six times larger.”So what exactly is cryptocurrency?This digital asset operates online, outside the traditional financial system. There is no physical version of the most popular form of crypto – bitcoin – and its peers, such as Ethereum, Ripple and Dogecoin.A cryptocurrency like Bitcoin runs on a combination of encryption, which is the sort of technology that keeps your WhatsApp messages safe, and peer-to-peer networks that allow computers to connect without a central server (think of the music sharing sites like Napster at the turn of the century).In short, the owner of a bitcoin (or part of a bitcoin – you can buy them in fractions) has access to a private key – like a long password – which is needed to access the funds. These transactions are all stored and displayed on a publicly available ledger, kind of like a school register, known as a blockchain. You typically store your private keys in a “crypto wallet”.There are varying estimates for how many cryptocurrencies there are but Coingecko, which monitors the market, claims there are more than 22,000 coins. The entire market is worth around $2.7tn, so it is not a surprise that hackers and rogue states looking for funds are interested in a corner of the global finance industry that has so much money, is largely unregulated and is vulnerable to digital thieves.And what is a cryptoexchange?A cryptoexchange is where you buy, sell and trade digital assets like Bitcoin. They host your crypto wallets, which are typically “cold”, meaning they are not connected online and can be kept safer from hackers. A smaller amount sits in “hot” wallets which are linked to the internet so they can be used for quick withdrawals, making them of greater interest to hackers. Binance is the world’s largest of these exchanges in terms of the number of trades it carries out every day – at a value of around $95bn daily.How was Binance hacked?It does not appear that private keys were hacked. Instead, a Binance engineer’s laptop infiltrated, which in turn allowed the attackers to drain “hot” wallets.“Hackers rarely crack the cryptographic keys themselves,” says Tom Robinson, chief scientist at Elliptic, a blockchain analytics company. “They instead target people with access to those wallets. Binance says the attack involved a compromised engineer’s laptop, along with other points of breach. This gave the attacker a way into Binance’s internal systems. From there, they made Binance’s own systems sign transactions that sent the funds to the attacker.”More than $2.5bn of the $6.3bn was taken in one transaction alone.“Crypto exchanges are safer than they used to be, but not immune to attacks such as this,” says Robinson. “This hack shows that even the biggest exchange can be breached through one employee’s laptop. What matters most for customers is whether the exchange can cover the loss. Binance says it will repay everyone from its own funds.”Do we know who did it?This attack has been attributed to a North Korean hacking unit called TraderTraitor, a name assigned to it by the US government. The communist state, short of cash and hamstrung by sanctions, has a strong track record of crypto hacking. TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.Last year TraderTraitor was blamed for the $1.5bn theft from the Dubai-based Bybit. Elliptic and two other crypto analysis firms have attributed the attack to North Korea. Elliptic said some of the funds taken from Binance have already been traced to wallet addresses used in a cryptoexchange hack last month that is also thought to have been carried out by operatives from the rogue state.Rafe Pilling , senior director of threat intelligence at cybersecurity firm Sophos, says North Korea had previously hacked conventional financial targets such as the Bangladesh Central Bank and even cash machines. But crypto delivers bigger potential rewards, he says.“Crypto is less well regulated, easier to move, easier to launder and that makes it a more enticing targetfor North Korea. And as a result you have groups like TraderTraitor that are specialising in attacking crypto firms and getting away with huge payments,” he says.Are my crypto investments safe? Any guarantees will be coming from Binance itself, rather than any regulatory or government-backed safety nets. The exchange said in a post on X that it would “cover all losses” and that “user funds are safe”. It also said it had frozen about half the funds targeted in the hack, stopping the thieves from making off with that tranche of cryptocurrency.In Australia, you can claim a capital loss on your tax return if you can offer proof that a crypto asset was lost or stolen. However, most customers won’t have any legal protections.Crypto users are not covered by formal deposit protections in countries such as the US, UK or Australia if things go wrong, including if an exchange is hacked or ever goes bankrupt.Customers of regulated banks are guaranteed capped refunds –up to £120,000 per customer per bank in the UK, and $250,000 in the US – but only if the lender goes out of business. It will not pay out claims if there is a hack but the bank keeps operating.