At 4:05 on Thursday afternoon, Eastern time, five wallets belonging to Binance, the largest cryptocurrency exchange in the world, sent 233 million units of a coin called XRP, worth about $296 million, to an address no one at Binance had ever approved. Over the next 20 minutes the same thing happened on Solana, on Bitcoin, on Tron, on Ethereum, and on a handful of smaller networks, one wallet after another emptying itself the way the lights go out floor by floor in an office tower at night, until roughly $6.36 billion had left the building.

The thieves never cracked Binance's encryption, and Binance says it has found no evidence that the secret codes controlling its wallets ever leaked. They did something older than encryption and a good deal simpler. They got Binance's own machinery to sign the withdrawal slips for them.

The FBI says the thieves work for North Korea. Elliptic, a firm that traces stolen crypto for banks and police, calls it almost certainly the largest theft of any kind on record. The record it replaces belonged to Saddam Hussein, who had about $1 billion hauled out of Iraq's central bank on the eve of the 2003 Iraq war. This one is more than 6x bigger, and nobody needed a truck.

Last week, I wrote about criminals who stopped hacking computers and started talking the owners into running the attack themselves. This week, the same idea shows up at a size that's hard to hold in your head. North Korea got Binance's own systems to approve the theft, then spent the rest of the night racing the people trying to freeze the money.

Some of you hold crypto, and some of you have never bought a coin and never intend to. I wrote this issue for both of you. Every crypto term gets translated into banking language as we go, because underneath the jargon this was a bank robbery, and you already understand how bank robberies work, e.g., someone cases the place, someone gets inside, the money goes out the door, and then comes the getaway.

At the end, the scam that started circulating before the thieves finished counting, and six rules for anyone who keeps money where someone else holds the keys.

A Bank With 10 Vaults

Think of Binance as a bank and a brokerage rolled together. Customers deposit crypto, and Binance holds it for them and trades it on their behalf. Most of what it holds sits offline in what the industry calls cold storage, which works like a vault on a time lock. A smaller amount stays online in hot wallets, so the exchange can pay out withdrawals all day without opening the vault every time. Those are the teller drawers and the ATMs. Binance co-CEO Richard Teng says the hot wallets that were drained held the company's own money, not customer balances.

Because crypto runs on many separate networks, Binance keeps a teller drawer on each one: one for Bitcoin, one for Ethereum, one for Tron, and so on. That's why this theft hit 10 networks at once. It's also why it's worth understanding how money leaves a drawer. A customer asks to withdraw, Binance's software checks the request, and a signing system applies the exchange's authorized signature, the way a bank's wire room stamps an outgoing wire.

The difference is what happens next. When a bank sends a bad wire, there's sometimes a window to call the receiving bank and claw it back. On a blockchain, a validly signed transfer is final the moment it lands. There's no recall and no fraud department on the other end, which is why everything in this story turns on who controls the signature.

Casing the Joint

According to TRM Labs, which traces crypto for governments and banks, the preparation started at least 36 hours before the theft. Starting on the morning of October 28, a brand new wallet received three small withdrawals from Tornado Cash, a service that pools many people's coins and pays them back out so no one can tell whose money came from where. Picture a check-cashing window where 1,000 people hand over bills and each walks away with someone else's. The three withdrawals came to 0.1 ether apiece, worth ~$700 combined. The largest theft in history started with less than a car payment, and that $700 was enough to cover the transaction fees for what came next.

Early on October 29, the crew put its theft program onto the blockchain and tried it out on two wallets. Later that day it ran a full rehearsal on a third wallet and routed the test money back to itself. About four hours after the rehearsal, the same program went to work on Binance.

Crews that hit armored cars drive the route first. This one drove it on a public ledger, where every test run is recorded permanently for anyone to read, and the record meant nothing to anyone until it was over.

The Inside Door

Binance's first explanation, posted hours after the theft, pointed to a single laptop. It belonged to a DevOps engineer, one of the people who keep a company's systems running and who need access to machinery the rest of the staff never touches. From that laptop, Binance said, the attacker reached a service container, a sealed compartment of software built to do one job. This one's job was submitting withdrawals. In bank terms, someone got hold of the facilities manager's badge, and the badge opened the wire room.

Binance has since said that its investigators found more points of breach than the laptop and that the attack was complex. Teng said in a video update that it wasn't the work of one person, and that the attacker used a self-destruct mechanism that wiped its own tools and traces as it ran. Binance hasn't published a root cause yet, and it hasn't said how the laptop was compromised.

I won't guess in print. I will tell you how this crew has gotten inside before. In 2024, the same North Korean group, which the FBI calls TraderTraitor, posed as a recruiter on LinkedIn and approached an employee of Ginco, a Japanese company that builds wallet software. The employee had access to the wallet management system. The fake recruiter sent a pre-employment coding test, the employee copied the code to a personal GitHub page, and the test was the break-in. About two months later TraderTraitor used that access to tamper with a legitimate transfer request at the exchange DMM Bitcoin and took 4,502.9 bitcoin, worth $308 million at the time.

Across years and targets, North Korea has left the math that protects crypto alone, because the math holds up, and gone after the handful of people whose computers can tell the math what to sign.

20 Minutes

Between 4:05 and 4:09 p.m. Eastern, the five Binance wallets on the XRP network sent their balances to a single address, each one left holding only the small minimum the network requires. Binance wallets on Solana and Optimism followed a little after 4:10. At 4:20, Binance's Bitcoin hot wallet sent 18,270 bitcoin, about $1.47 billion, to an address that started chopping the pile into round pieces of 1,000 and 100 coins within the same block. Investigators call that a peel chain. A launderer with a $1 million check does the same thing when he splits it into dozens of smaller deposits so no single one draws attention. Within 2 minutes, a Binance hot wallet on Tron sent 612.7 million digital dollars and a pile of Tron's own coin, about $628 million in all.

The biggest move came on Ethereum, and it used the power of attorney from the box above. At 4:20, the attacker submitted a single transaction carrying 50 authorizations, every one of them validly signed by one of Binance's best-known Ethereum hot wallets. Each authorization handed control of that wallet to the attacker's program, a sweeper that takes orders from no one but its owner.

Why 50? Every wallet keeps a running count of its transactions, the way a checkbook prints a number on every check, and an authorization works only if it carries the number the wallet is on at the moment it lands. Binance's hot wallet pays out withdrawals all day, so its count never sits still. A forger who can't know which check number the bookkeeper will be on by the time he reaches the teller gets 50 checks signed in advance, each with a different number, and walks in knowing one of them will match, and one did.

3 minutes and 24 seconds later, the attacker told the wallet to send everything it held to an address the attacker controlled. That one transaction moved 167,464 ether and 63 other tokens, including 1.6 billion digital dollars. Elliptic puts the value of that single transfer at $2.53 billion!

A power of attorney doesn't expire when the agent uses it, and this one didn't either. New money kept arriving in that hot wallet through the evening, and the attacker kept sweeping it out, at 4:41, 4:59, 5:04, 5:44, 6:39, and 7:56. The wallet also happened to hold signing authority over a separate Binance account, the way a family member with power of attorney might also be trustee of the family trust, and the attacker used that authority to pull 823 million USD Coin, another digital dollar, out of the second account.

Everywhere else, nobody needed a trick. Binance wallets simply sent their money to the attacker in ordinary signed transfers. Those wallets run on different networks with different kinds of keys and different signing methods, and all of them produced valid signatures for the attacker within about half an hour. TRM's assessment is that the attacker had gained the ability to make Binance's signing system sign whatever it asked for. Bybit learned the same lesson in February 2025, when this same group compromised a developer's computer at the wallet company Bybit relied on and walked off with $1.5 billion. In both cases the cryptography worked exactly as designed, and the people and machines around it were the way in.

The Getaway

Stealing $6 billion and keeping it are different problems. About $3.46 billion of the haul, by Elliptic's count, was in digital dollars, and digital dollars come with an issuer who can freeze them. The thieves were holding a very large pile of cashier's checks, and the banks that wrote them were waking up.

Tether, which issues the most widely used digital dollar, froze the attacker's main receiving wallet at 5:01 p.m., 37 minutes after the big sweep, and locked about 1.18 billion of its tokens in place. Circle froze the 823 million USD Coin 3 minutes later. Ripple, World Liberty Financial, Paxos, and First Digital froze their own tokens. Arbitrum, a network that runs on top of Ethereum, has a Security Council with emergency powers, and at 8:08 p.m. it used them to force about $30 million out of the attacker's wallet on its network. Elliptic has verified $2.85 billion frozen or seized, close to Binance's own estimate of about $3 billion.

The thieves saw it coming and tried to trade their cashier's checks for cash before the stop-payment orders arrived. According to TRM, they sold about 325 million digital dollars to professional trading firms in exchange for ether at a price more than 10% worse than the market, which is roughly what a fence charges for hot jewelry. A second wallet deposited about 60 million digital dollars with Aave, a lending service, and borrowed about 19,760 ether against it, the way a thief might pawn a stolen watch instead of selling it and walk out with clean money, leaving the hot goods in someone else's back room.

Then the laundering began, and much of it looks automated. Elliptic counted 1,113 separate transfers out of the attacker's main Tron laundering wallet between October 30 and November 1, with a median gap of 90 seconds between them, running straight through both nights in Pyongyang. The amounts are randomized down to 6 decimal places, a habit of software written to slip past simple monitoring rules.

As of Sunday, Elliptic estimates the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. The 233 million XRP taken in the first 4 minutes hasn't moved at all. The laundering of the Bybit money took months, and Elliptic expects the same here. Every time those funds touch an exchange or a broker to become spendable money, they can be caught, which is why the FBI published 628 attacker addresses and asked the industry to block them.

Who Pays

Binance says its customers won't. It set aside more than $6.34 billion of company money, including its SAFU fund, an emergency reserve it built and funds itself, and by the weekend it said it had replaced about 95% of the stolen assets. Withdrawals started reopening in phases on November 1, and the exchange published a reserves check for its 10 biggest coins so customers can confirm their balances are fully backed. Binance.US, which serves American customers, says it wasn't affected.

That outcome deserves a moment of attention, because it was a choice that depended on Binance having the money to make it. A bank deposit in the United States carries FDIC insurance up to $250,000. Crypto held on an exchange carries whatever protection that exchange can afford on the worst day of its life. Bybit could afford it in 2025. When FTX collapsed in 2022, its customers learned what happens when an exchange can't: they stood in a bankruptcy line as creditors.

The rest of the bill goes somewhere less abstract. The U.S. government has linked North Korea's crypto thefts to funding its weapons programs. Before last Thursday, Elliptic tracked more than $6.5 billion stolen by North Korea-linked groups in recent years, and this single night nearly doubled it.

The Second Crime

Every big breach comes with two frauds: the theft itself, and a second one aimed at the victims, which usually arrives faster than the official explanation. Within days of the Binance theft, fake posts and doctored screenshots were circulating on social media claiming Binance would pay $150 in compensation to customers inconvenienced by the withdrawal pause, with instructions for claiming it. Binance says the screenshots are fake. Its co-founder, Changpeng Zhao, put the warning more bluntly.

The trick North Korea used on Binance's hot wallet has been used on ordinary people since the day the feature launched. Within weeks of the May 2025 Ethereum upgrade that introduced delegation, the trading firm Wintermute found that more than 97% of delegations on the network pointed to copies of the same wallet-draining program. Scam sites learned to dress the authorization up as an "upgrade," a "claim," or a routine approval. In May 2025, one user of the popular MetaMask wallet lost about $146,000 after approving one of those disguised transactions. In August, another lost $1.54 million the same way.

If you don't own any crypto, the lesson still applies to you. The Binance thieves never stole the signature; they got the system holding it to say yes. Your company's wire approvals, your bank's payment authorizations, and the email asking finance to update a vendor's account all rest on the same assumption, that an approved request is a wanted request. The fix is the same everywhere, too. No single system and no single person should be able to move serious money alone, and confirmation has to come through a channel the requester doesn't control.

Field Manual

Six rules, whether you hold crypto, run a company treasury, or just want to keep the next fake refund offer out of your parents' phone.