How do you steal $6 billion without a gun?

At 8:05 pm UTC on Thursday, 4:05 in the afternoon in New York, five wallets belonging to the world’s biggest crypto exchange started sending money to a stranger.

Twenty minutes later, most of $6 billion had left Binance. Nobody had cracked a safe or pointed a gun at anyone. By every account so far, Binance’s own computers had signed for every transfer.

Elliptic, one of the firms tracing it, calls it “almost certainly the largest theft of any kind in history”. The record before it, not counting inflation, was set last year, when the same kind of thief took $1.5 billion from another exchange, Bybit. The biggest bank robbery on record, the $1 billion Saddam Hussein’s son took from Iraq’s central bank in 2003, needed three trucks.

So how do you steal $6 billion without a gun? Nobody outside the investigation knows every detail yet, and Binance hasn’t published its post-mortem. But between Binance’s own statements and the firms that trace stolen crypto for a living, the shape of it is clear. It comes in five steps.

Step 1: Pick the till, not the vault

An exchange like Binance keeps most of its customers’ coins in cold wallets: offline, like a safe in the back room, and slow to open on purpose. It keeps a smaller amount in hot wallets, which are online so that withdrawals can go out in seconds. That’s the till.

Binance’s tills were big, but the whole shop was far bigger. It held about $144 billion in crypto before Thursday, by DefiLlama’s count, so the thief took about 4% of it. Every wallet that was emptied was a hot one; nobody has said a cold wallet was touched.

Step 2: Get inside one laptop

Binance’s first explanation came about six hours later, at 2:25 UTC (10:25 pm in New York): the incident “may involve a compromised DevOps engineer’s laptop,” which “may have allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

A DevOps engineer keeps the company’s systems running, so their laptop is a door into the building. Binance says it has found no sign that the keys to the wallets were stolen. “We have found no evidence of any wallet private key leak,” it said.

Over Friday the story grew. “The attacker did not simply use one engineer’s permissions,” Binance’s co-chief executive, Richard Teng, wrote, “and this was not a single ‘one-click’ action.” The company had found “additional points of breach”, and malware built to destroy itself and its traces, “making it more difficult for us to trace and investigate.”

How the laptop was broken into hasn’t been published. When the same kind of thief robbed Bybit for $1.5 billion last year, it started with a developer’s laptop too, seventeen days before the money moved.

Step 3: Get the bank to sign your cheques

Signed by Binance

Here is the clever part. A crypto wallet only sends money when the transfer is signed with the right digital key. As far as anyone can tell, Binance didn’t lose its keys. The thief got Binance’s own signing system to sign for him, the way you might get a bank to sign a cheque without ever touching its pen.

On nine of the ten blockchains, those were ordinary, properly signed transfers. On Ethereum, where the biggest wallet sat, the thief went further. Since an upgrade last year, an Ethereum wallet can sign a permission slip that turns it into a little program, and it stays that way until the wallet signs another slip to undo it.

A slip like that only works if it carries the exact transaction number the wallet is up to, and an exchange wallet’s number moves on with every withdrawal it sends. So the thief had Binance’s system sign fifty of them, one for each number in a row.

One fitted. A Binance Ethereum hot wallet known as Binance 14 became a vacuum cleaner that only the thief could switch on. Teng said later that this change “did not pass through our normal approval controls.”

Step 4: Go fast

At 20:05 UTC, five Binance wallets on the XRP Ledger started sending 233 million XRP to a single address. Solana went next. At 20:20, Binance’s Bitcoin wallet sent 18,270 bitcoin, about $1.47 billion, in eleven transfers that all landed in the same block. Tron followed within two minutes. At 20:24 and 23 seconds, the vacuum cleaner was switched on, and one Ethereum transaction carried off about $2.5 billion.

“Most of it in about 20 minutes,” wrote TRM Labs, one of the firms that traced it. At 21:15 UTC, Binance’s founder, Changpeng Zhao, posted on X: “User funds are safe! It does look like a hack on Binance.” Binance’s first statement, a minute later, said it hadn’t “confirmed any impact to user funds”. Within a quarter of an hour it had been edited twice, and ended up saying user funds were “completely safe”.

Then came the strangest few hours. A permission slip on Ethereum doesn’t expire when the thief leaves. Binance’s own robots carried on doing their job, sweeping customers’ new deposits into the hot wallet, and the thief kept coming back to empty it: six more times over the next three and a half hours. At 21:44 alone, it took another $200 million.

Step 5: Get away with it

This is where the thief hit a wall. More than half of what was taken was digital dollars: Tether’s USDT and Circle’s USDC, coins that are meant to be worth exactly a dollar each. The companies behind them can freeze any coin they’ve issued, wherever it sits.

Tether froze $971 million at 21:01, thirty-seven minutes after the big sweep. Circle froze $823 million three minutes later. Ripple, World Liberty Financial and others followed. By Friday morning, about $3 billion was frozen, by Binance’s count.

Before the freezes landed, the thief swapped about $786 million of digital dollars into Ether and Tron’s TRX, at discounts of up to a quarter, the crypto version of fencing jewellery for scrap. But it sat on most of them for more than half an hour, and that is what got frozen. Everything else is in coins nobody can freeze. The bitcoin was split within minutes into nineteen wallets, seventeen of them holding exactly 1,000 bitcoin each. As of Friday morning it hadn’t moved.

It will. After Bybit, North Korea’s hackers took about ten days to turn the stolen Ether into bitcoin. Every step happens in public, on blockchains anyone can read, and the most watched money on earth has a way of getting away anyway.

You can watch it happen. Where’s the $6 billion? checks the thieves’ wallets every 10 minutes, shows what moved and where, and lines it up against what North Korea’s hackers did after their last big thefts.

Update, 1 November: the first coins moved on Saturday. By 05:40 UTC on Sunday, the thieves’ Tron wallets were empty: about 412 million TRX, worth about $128 million, gone in fifteen moves. As of 06:30 UTC, the bitcoin, the Ether, the XRP and the Solana hadn’t moved. The FBI said on Saturday that the thieves had been turning the stolen coins mostly into Ether, and asked crypto services to block the hundreds of addresses they’re using to launder it.

Update, 2 November: the getaway has started. Between 03:52 and 04:00 UTC on Monday, around 11 pm Sunday in New York, all 233 million stolen XRP, about $294 million, went from the thieves’ wallet to six new ones. Since Sunday morning more than half the Solana, about $51 million, has left its wallet; Lookonchain, which watches wallets for a living, says it is being swapped into bitcoin through a bridge called Relay. By Sunday about $242 million of the Tron money had crossed to other blockchains through Relay, THORChain, Chainflip and Symbiosis, by the count of SomaXBT, an analyst with the Security Alliance. One road closed by accident: THORChain paused most of its trading on Saturday over an unrelated bug. The bitcoin and the Ether still hadn’t moved at 09:30 UTC. At Binance, customers took out a net $3.64 billion on Sunday, the first day withdrawals were back, and the proof of reserves slipped to Tuesday. Circle said on Monday it had now frozen more than $1.1 billion of its USDC.

The suspect

Name

TraderTraitor, as researchers call one of North Korea's state hacking groups.

Earlier jobs

Bybit, $1.5 billion, February 2025, says the FBI. Bitget, $388 million, in September, which Bitget blamed on North Korea.

Method

Get into a developer's computer. Wait. Get the company's own system to sign the transfer.

Evidence

The next morning, money from Binance and money from the Bitget hack turned up at the same address.

Status

Named by the FBI, with the Secret Service and the IRS, on Saturday, and by TRM Labs and Chainalysis; "likely", says Elliptic. North Korea routinely denies hacking and didn't respond to Reuters.

“Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address,” the investigator ZachXBT posted on Friday morning. “This indicates the same actor is likely behind both incidents.” Elliptic, more cautious, notes the overlap is small and could be a shared launderer.

If the FBI is right, here is what the money is for. A United Nations panel said in 2024 that it was investigating 58 suspected North Korean cyberattacks between 2017 and 2023, worth about $3 billion, and one government estimated that cybercrime brings in about half its foreign currency, which pays for its weapons programmes. By Elliptic’s count, North Korea had stolen more than $6.5 billion in crypto before Thursday night. One night nearly doubled it.

Who pays

Binance says it will. “Binance will absorb the financial impact of these stolen funds, not our users,” its two chief executives wrote late on Friday. It has set aside $6.34 billion of its own money, most of it already in the same coins that were taken, and its emergency fund for exactly this, called SAFU, holds about $1 billion.

Zhao did the sums in public: “$6.x b hack, $3b frozen, $1.x b SAFU fund… Gap is about $2b, we have $1.x billion in SPCX alone,” meaning shares in SpaceX. “It hurts, but we will survive.” Withdrawals were paused from Thursday night until Sunday, when Binance began reopening them in stages: the Bitcoin network was back by 06:25 UTC, with fourteen more to follow as each passes its security checks. By then Binance said it had replaced 95% of the stolen coins; the rest are smaller tokens that take longer to buy. It says ten major coins, bitcoin and Ether among them, are fully backed, and the proof that lets anyone check is due by Tuesday.

Compare WazirX, an Indian exchange. In July 2024, hackers linked to North Korea took about $235 million from it. Its users waited fifteen months and got back about 85%. The difference this time may not be the thief. It’s that the victim is big enough to pay.

For scale

Ten years ago, hackers the US says worked for North Korea tried to take $951 million from Bangladesh’s central bank, through its account at the New York Fed, and moved $101 million before the rest was stopped. The FBI says Thursday was them too. This time they took about sixty times that, most of it in about twenty minutes, without anyone leaving their chair.

What I actually took away:

• Nobody broke the vault. The thief went for the till, starting with one laptop and working its way to the pen.
• A system that signs everything automatically will sign for a thief too. Binance’s own robots kept refilling the till while the thief emptied it.
• Digital dollars can be frozen; bitcoin can’t. This week that cut both ways.
• Money on an exchange is a promise from the exchange, not coins in your pocket. This time, the promise looks like it will be kept.

Sources (20)

• TRM Labs (29 October 2026). “North Korea steals USD 6.36 billion from Binance in the largest hack in history.” The timeline, the amounts per chain, the fifty authorizations and the sweeps that followed.
• Elliptic (30 October 2026). “The largest theft in history: North Korea likely behind the $6.4 billion Binance hack.” The frozen and held totals, the swaps before the freezes, and the caveats on attribution.
• Blockaid, via FinanceFeeds (30 October 2026). The 20:20:59 transaction with fifty authorizations, the 20:24:23 sweep and the $200 million at 21:44. FinanceFeeds also tracked the edits to Binance’s first statement. Blockaid’s own incident report has the transaction addresses linked in Try it.
• Chainalysis (30 October 2026). “Binance exploit: latest findings and response.”
• Conor Grogan, via Gizmodo (30 October 2026), on Binance’s deposit sweeps refilling the hot wallet.
• ZachXBT on X, 30 October 2026, on the commingled funds.
• Binance’s statements and Richard Teng’s posts and video, 29 to 31 October 2026, as reported by Decrypt (additional points of breach, the $6.34 billion), Cointelegraph’s live blog and Bitcoin.com. Reuters (31 October) for Teng’s “making it more difficult” and North Korea’s standing denial.
• CoinDesk (30 October 2026) on the bitcoin split into nineteen wallets, on Binance 14 in Binance’s proof of reserves, on the $144 billion (29 October), and on the SAFU fund.
• TheStreet (30 October 2026) for Changpeng Zhao’s sums, and Finbold for “It hurts, but we will survive.”
• The FBI’s statement of 31 October 2026, with the Secret Service and IRS Criminal Investigation, as reported by CoinDesk: TraderTraitor, the coins turned into Ether, and the addresses to block.
• Reuters (1 November 2026) for the 95% replaced and the reopening in phases; TechFlow for the Bitcoin network reopening first, at 06:25 UTC; Bitcoin.com (31 October) for the ten fully backed coins and the proof due by Tuesday. The Tron moves in the 1 November update, and the Solana and the still bitcoin and Ether in the 2 November one, are from this site’s tracker.
• Bitcoin.com (2 November 2026) on the XRP moves and on the proof moving to Tuesday; The Block (1 November 2026) for SomaXBT’s Tron count, Lookonchain on the Solana and THORChain’s pause; Reuters (2 November 2026) for the $3.64 billion and Circle’s $1.1 billion.
• Aikido on the Bybit timeline: the developer’s laptop, 4 February 2025; the theft, 21 February.
• The Register (25 September 2026) on Bitget.
• Guinness World Records, “Greatest robbery of a bank by a statesman”: Iraq’s central bank, 2003.
• The FBI on the Isabella Stewart Gardner Museum theft, 1990.
• The FBI on Bybit (February 2025) and on Ronin (April 2022), via BleepingComputer.
• The Bangladesh Bank robbery, 2016: the attempted and moved amounts, and the US charges against a North Korean programmer.
• The 2024 WazirX hack: the amount and the recovery.
• The UN Panel of Experts (March 2024), as reported by ABC News Australia.