The money did not disappear in a vault nor was it necessary to force the door of a bank. It was enough for some digital orders to open the way. This week a cyberattack allowed approximately $6.36 billion in cryptocurrencies to be transferred from Binance walletsthe largest exchange platform for these assets, according to TRM Labs analysis. Most of the money left in about 20 minutes. If the attribution handled by several specialized companies is confirmed, the attack would be related to TraderTraitor, a group of cybercriminals linked to North Korea. The figure makes the incident the largest cryptocurrency theft known to date, above the attack against Bybit in February 2025, in which around $1.5 billion disappeared.
The economic dimension is impressive, but the most disturbing question is another: How can billions be stolen from a financial infrastructure that relies on cryptographic systems designed to protect transactions? The provisional answer points to a fundamental difference between breaking the mathematical security of a network and getting systems authorized to operate on it to execute illegitimate orders.
Binance has explained that its initial investigation targets a compromised laptop of a DevOps engineerthe technical area that maintains and deploys a company’s IT services. That access would have allowed the attacker to reach a service container and file unauthorized removal operations. However, the company has warned that subsequent investigation has uncovered other possible entry points. It has not yet released a full technical reconstruction and says it has found no evidence that the private keys of the affected wallets were leaked.
This distinction is important. Blockchains, such as Ethereum or Bitcoin, record operations using cryptographic mechanisms that allow verification that a transaction complies with the network’s rules. But These mechanisms alone do not guarantee that the person or system ordering an operation is acting legitimately.. If an attacker manages to control or manipulate the process that authorizes a transfer, they can attempt to exploit existing permissions without needing to crack the cryptography that protects the network.
In the case of Ethereum, TRM Labs describes the use of a technical function that allows certain operations of an account to be delegated. According to their analysis, the attacker would have taken advantage of this mechanism to convert a Binance hot wallet (a wallet connected to the internet and used to move funds quickly) into a transfer instrument under his control. In other networks, assets left through signed transfers that, viewed from the blockchain itself, appeared to be valid operations. The definitive details will have to wait for Binance’s technical report, but The case illustrates a problem that goes beyond a specific cryptocurrency: security also depends on how permissions are managedauthorizations and devices that can order money movements.
The response to the attack has highlighted another feature of the ecosystem: although transfers on a blockchain can be difficult to reverse, some digital assets can be frozen. Binance says it has collaborated with other companies to block approximately $3 billion related to the incident. Among the tools available are the powers of issuers of certain stablecoins, such as USDT and USDC, to prevent some tokens from moving from identified addresses. This possibility does not exist in the same way for all assets: bitcoins, for example, cannot be frozen by an order from a central issuer.
Binance has announced that it will cover the losses with its user protection fund, known as SAFU, and with its own resources.. The company has also temporarily suspended certain operations while it reviews its systems and works with technology partners and authorities to track funds. The freezing of a part of the loot does not mean that all that money has been definitively recovered.
The incident leaves a lesson that transcends the universe of cryptocurrencies. Technology can verify a digital signature, but it cannot always determine whether the person who generated it had a legitimate intention.. In a financial infrastructure, protection requires several barriers: secure devices, limited permissions, independent controls for sensitive transactions, and mechanisms capable of detecting anomalous behavior before they become an irreversible succession of transfers.