Binance crypto theft: Here's how North Korean hackers perfected the heist, stole $6.3 billion in 20 minutes | Details

The FBI has blamed North Korea for the record $6.3 billion Binance theft. Researchers say the hackers moved billions within minutes and rapidly erased evidence, raising questions about how automation is reshaping cybercrime and helping attackers carry out increasingly sophisticated financial heists.

Binance, the world's largest cryptocurrency exchange, recently became the target of North Korean hackers, who stole an estimated $6.3 billion within 20 minutes.

According to Axios, North Korean hackers have carried out the world's biggest cryptocurrency heist, building on more than a decade of financial theft and disruptive cyberattacks. Their cryptocurrency thefts have now grown into an industrial-scale operation.

How did the North Korean hackers perfect the heist?

The suspected hackers behind the massive $6.3 billion Binance theft seemingly combined familiar hacking tactics with extraordinary speed and automation, raising concerns regarding the use of artificial intelligence (AI) and how it could supercharge their already sophisticated methods.

Citing researchers at TRM Labs, the report added that the hackers started preparing for this attack roughly 36 hours before it began. They also laundered the stolen funds and wiped out evidence of their operations at an unprecedented speed, indicating they used automation throughout the heist.

Eric Jardine, head of research at Chainalysis, said, "There were transactions happening with a frequency and a scale that just meant there could not have been someone involved in the approval of these," and added, "It had to have been done by a computer."

According to Binance co-CEO Richard Teng, the attackers used a "self-destruct mechanism that destroyed tooling and traces."

FBI blames North Korea's TraderTraitor for Binance crypto theft

The Federal Bureau of Investigation (FBI) has since attributed the theft of more than $6 billion from Binance to North Korea, identifying the operation as TraderTraitor. In a statement released on Saturday (local time), the bureau said that this week's attack was tied to "malicious cyber activity" by an entity known as TraderTraitor, the same actors behind a $1.5 billion Bybit hack last year.

The bureau further said that its preliminary probe revealed that TraderTraitor was converting stolen assets into a cryptocurrency called Ethereum, AP reported, adding that the FBI now expects the group to try to convert the assets using DeFi and "instant swap services."

1. In 2016, hackers tried to steal roughly $1 billion from Bangladesh's central bank and managed to steal $81 million.

2. In 2017, North Korea was accused of being behind the WannaCry ransomware outbreak, which disrupted hundreds of thousands of computers in over 150 countries.

In the last few years, North Korea has increasingly targeted cryptocurrency exchanges, partly because digital assets are easier to move and launder across borders, though these thefts often leave a more traceable record.

The theft highlights the growing scale and speed of North Korean cyberattacks, raising questions about how cryptocurrency exchanges can strengthen their defences against increasingly sophisticated hackers.