The $6.3bn Binance theft appears to have hijacked the system that authorised withdrawals

Attackers removed approximately $6.3bn of cryptoassets from Binance hot wallets across ten blockchains in roughly 20 minutes. Binance initially suspected a compromised laptop, then said it had found additional breach points and no evidence that wallet private keys leaked. TRM Labs' preliminary assessment is that the attackers compromised signing infrastructure: the system that authorises transactions rather than the cryptographic keys at the bottom of it. Binance has not yet published the complete attack sequence.

The distinction matters. Protecting a key is insufficient if software, credentials or human workflows can instruct the protected key to approve a malicious transfer. A hardware security module can faithfully sign the wrong transaction when the policy layer above it has been subverted. The scale and speed imply that containment had to occur outside Binance after the withdrawals began. Stablecoin issuers and industry partners froze about $3bn on-chain, showing both the usefulness and the centralised control embedded in ostensibly decentralised assets. Frozen tokens are not automatically recovered, but they become much harder to liquidate.

Binance says it will absorb the loss through its corporate treasury and user-protection fund. It has set aside more than $6.34bn, including $5bn already held in the affected assets, and is buying the remainder. Withdrawals were suspended while systems were reviewed. A new proof-of-reserves snapshot can show whether customer liabilities are backed after the loss; it cannot establish that the authorisation path is secure.

TRM attributes the operation with high confidence to North Korea's TraderTraitor group, citing on-chain and off-chain intelligence and similarities to the Bybit attack. Binance says it has not identified the attacker, and North Korea routinely denies such accusations. The attribution should therefore remain provisional. The immediate verifiable lesson is architectural: the security boundary includes every system able to produce, approve and broadcast a valid instruction, not only the wallet key itself.