According to Korea's New Daily and the U.S. outlet TechCrunch, the incident began around 4:05 p.m. local time on the 29th, when assets started leaving 10 Binance blockchain wallets. That was about 5:05 a.m. on the 30th in Korea. XRP went first, followed by Solana-related wallets, 18,270 bitcoin and roughly 612.7 million Tether (USDT).

Blockchain analytics firm TRM Labs called it the largest hack in history and attributed it to North Korean hackers. Elliptic said some of the stolen funds turned up in the same wallet used in the $351 million Bitget theft earlier this year, also pointing to North Korea. The group has been named in connection with the roughly $1.4 billion Bybit theft in 2025.

How the attack unfolded

Binance said its initial investigation found that attackers targeted the laptop of a 'compromised' engineer, gained access to a service container and submitted unauthorized withdrawals. The company says it has seen no evidence that private keys leaked. How the laptop was breached, and how one employee's device could reach systems controlling billions of dollars, has not been disclosed.

New Daily reported that the attackers hurriedly swapped stablecoins that could be frozen into assets such as bitcoin and ether, in some cases paying above market price, which is read as an effort to avoid freezes. There were also signs they sent small test transfers before moving large sums. Overseas analysts raised the possibility of automated tooling, but that remains conjecture.

Freezes and making users whole

Tether reportedly froze about $1.57 billion and Circle about $800 million, and Binance said on the 30th that industry partners had frozen around $3 billion. TechCrunch reported that roughly half of the total was caught as it moved. Critics note, however, that large-scale freezes came more than an hour after the attack began, by which time much had already been converted.

Binance says user funds are safe and that it will cover losses from its Secure Asset Fund for Users (SAFU) and company reserves. Suspended deposits and withdrawals will resume in stages, and an updated proof of reserves is promised once remediation is complete. The FBI and Secret Service are cooperating on the investigation, but the amount recovered and final responsibility are not yet confirmed. Whether the case will prompt security checks at Korean exchanges, and any official Korean government position, could not be confirmed in this report.