How Pirates Steal Billions from the Cryptocurrency Market?

Binance, the world’s largest cryptocurrency exchange, announced it would take full responsibility for addressing the fallout from the massive security breach it suffered, pledging to compensate users for their losses and work to restore withdrawal services within 34 hours, in what is described as the largest incident in the history of the digital assets sector.

The platform stated that it had launched a comprehensive security review of its systems and infrastructure following the theft of digital assets estimated at around $6.3 billion, according to TRM Labs, a blockchain analytics firm.

The company explained that the stolen funds were moved from its wallets across 10 different networks in just about 20 minutes, an operation more than four times larger than Bybit’s $1.5 billion hack in 2025.

Binance, the world’s largest cryptocurrency trading platform, estimates the value of assets affected by the cyberattack targeting it at around $6.3 billion, an incident that highlights the security risks facing the cryptocurrency sector.

Binance leads globally in trading volume among digital currency exchanges and claims to have 335 million users. For comparison, Crypto.com counted 741 million people worldwide who own cryptocurrencies.

However, the company has faced a series of scandals. In April 2024, its former CEO, Changpeng Zhao, was indicted in the United States for violating anti-money laundering regulations, before former US President Donald Trump pardoned him last year.

The platform faces other legal proceedings in the United States, where it has been accused of selling assets equivalent to securities without registering them with the US Securities and Exchange Commission.

In France, Binance is suspected of failing to meet its obligations regarding customer fund source verification and monitoring.

After failing to obtain the required license under the European Union’s Markets in Crypto-Assets (MiCA) regulation, the giant platform announced this summer that it would suspend part of its activities in the European Union.

Cryptocurrencies rely on a technology known as “blockchain,” a digital ledger that maintains transaction history, making data forgery extremely difficult due to its design.

However, this does not prevent thefts, as fund transfers require the use of private keys, long strings of characters that must remain secret.

Digital wallets are used to manage these keys, not to store the cryptocurrencies themselves, as their transfers are recorded on the blockchain. Thus, anyone who obtains these keys can transfer funds without needing to tamper with the digital ledger.

Stefan Efraim, an analyst at CoinHouse, told AFP, “Even when you think you are dealing with one of the most secure trading platforms in the world, it can still be hacked.”

Some keys are stored in offline hardware wallets. However, these devices are not immune to attacks; some users of the French company Ledger, which specializes in this field, had funds stolen after malicious components were implanted in devices marketed through a distributor.

In Binance’s case, the investigation is focusing on a “compromised laptop” belonging to an engineer, before “additional vulnerabilities” were discovered, as the platform announced on X. The precise circumstances of the attack are still being determined.

The stolen amount is four times greater than what the same group had seized from the Binance platform in February 2025, in an operation valued at $1.5 billion, which was the largest of its kind in the cryptocurrency world at the time, according to the U.S. Federal Bureau of Investigation (FBI).

According to Elliptic and Chainalysis, part of the funds stolen from Binance were mixed with money taken in the recent hack targeting Bitget, an attack attributed to Pyongyang.

President Trump told reporters, in response to a question about whether the attack should be attributed to a North Korean hacker group, “We are considering this possibility.”

Binance announced the freezing of assets worth approximately $3 billion, representing about half of the total value of assets affected by the hack, with the assistance of issuing entities and partner companies providing the necessary infrastructure. Efforts are ongoing, but freezing the funds does not mean they have been actually recovered.

Stefan Efraim believes that the perpetrators of the theft may resort, for example, to paying Russian or Chinese partners with the stolen cryptocurrencies, with these partners then tasked with obscuring the illegal source of the funds.