One laptop, 20 minutes and $6bn: Is North Korea now the world’s biggest bank robber? - The Independent

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Smash-and-grab bank heists are nothing new. Robbers know they need to capitalise on the element of surprise to steal away as much cash as possible in as short a time as they can. But no robbery has managed to steal $6bn in 20 minutes.

That was until last night, in what has been described as the biggest hack in history, as crypto exchange Binance was hit by an attack analysts say align with a notorious North Korea-aligned hacker group who go by the name TraderTraitor.

Binance is the world’s biggest cryptocurrency exchange. As an exchange, it lets customers buy, sell and store cryptocurrencies like Bitcoin and Ether, just as a bank lets its customers deposit their money within its vaults. Being such a large hub for deposits made it a prime target for hackers, who moved quickly.

The blockchain intelligence company TRM Labs says most of the money was moved in around 20 minutes on Thursday evening, across 10 separate blockchains. The TraderTraitor group has previously been behind other massive heists: the FBI blamed it for stealing $1.5bn from another exchange, Bybit, in February 2025. The US Treasury said in November 2025 that North Korean hackers had stolen more than $3bn over the previous three years, using the ill-gotten gains to help finance the country's nuclear weapons and ballistic missile programmes.

But not all the $6bn in crypto ended up being successfully transferred. Just minutes into the heist, others within the crypto community noticed the scale of the transfers as crypto wallets, in which reserves are stored, were being drained, and took action to freeze transactions. As a result, around half the assets that were attempted to be stolen were frozen. The remainder will be reimbursed by Binance, the exchange has already confirmed, so customers won’t be out of pocket – even if the company will be. Binance also halted all withdrawals from its exchange in order to stop any further illicit transfers taking place.

Binance says its early investigation points to a compromised laptop belonging to one of its DevOps engineers, who work on the systems keeping its services running. From there, attackers may have gained access to a service that could request withdrawals from accounts. Binance says it has found no evidence that the private cryptographic keys protecting its wallets were leaked, though it says its investigation is continuing.

“The attackers didn’t break the encryption or steal the private keys,” says Jayant Dave, Asia-Pacific chief information security officer at cybersecurity company Check Point. “They took over the system that tells the keys what to sign.” In other words, rather than cracking the safe, they may have persuaded the systems controlling the locks to pry the safe door open.

The whole point of Bitcoin is that you hold it, rather than a third party holding it for you. Leaving large sums sitting on an exchange hands that control straight back

A similar MO was behind a 2024 attack by North Korean hackers, who posed as recruiters on LinkedIn, persuading an employee of Japanese cryptocurrency software company Ginco to download what appeared to be a coding test for a potential job. It contained malicious software that helped the hackers gain access to internal communications, giving them enough internal secrets to divert $308m from cryptocurrency exchange DMM Bitcoin.

Japan's foreign ministry warned last year that North Korea's cyber force had expanded into a “full-scope national programme”, approaching the kind of sophistication that can be deployed by China and Russia. North Korean hackers reportedly work through networks of operatives stationed abroad, including in China, Russia and Southeast Asia, and number some 6,000 worldwide.

The hack has an impact beyond the small proportion of people who hold cryptocurrencies – eight in every 100 Brits reportedly hold some form of crypto, according to the Financial Conduct Authority. Those holding currencies like Bitcoin were affected as the price fell more than 3 per cent in the immediate aftermath of the breach, and around $1.5bn in leveraged cryptocurrency bets were liquidated as investors who had borrowed money to bet on rising prices suddenly found their positions closed when the markets moved against them.

The sudden catastrophic incident – and the domino effect it had across the crypto world – highlights the biggest concern for the nascent financial sector: confidence. “The whole point of Bitcoin is that you hold it, rather than a third party holding it for you,” says Nigel Green, chief executive of financial advisory firm deVere Group. “Leaving large sums sitting on an exchange hands that control straight back.”

And for a sector that’s banking on breaking into the mainstream, that matters. Last year Donald Trump signed legislation regulating dollar-backed stablecoins – digital tokens akin to a cryptocurrency designed to hold a steady value and increasingly pitched as a way to make payments. He also ordered a review of rules governing American retirement plans, to allow them better access to alternative assets including cryptocurrency. It could mean relative novices to the world of crypto begin investing in these alternative finance sources, without necessarily realising the potential consequences of falling victim to a hack like this.

And crypto is something of a Wild West when it comes to incursions: TRM Labs documented around 150 crypto hacks or exploits in 2025, or an issue every two-and-a-half days. It’s little wonder, then, that trust in crypto remains relatively low: two-thirds of Americans told the Pew Research Centre they don’t have any confidence that current ways to invest in crypto are safe.

Those who have invested in crypto will have to be careful about potential follow-up hacks, cautions Justas Pukys, senior product manager at cybersecurity firm Surfshark. “Criminals could exploit the panic surrounding the incident to trick people into handing over their savings,” he warns. “Scammers may pose as Binance representatives, sending convincing emails or text messages warning that accounts are at risk or offering to help recover stolen funds.” There are likely to be some claiming to work in Binance’s security team and urging users to transfer their cryptocurrency to a supposedly safe wallet. “In reality, following these instructions could mean handing your money directly to criminals,” Pukys says.

“For the public, the message is uncomfortable but important,” says Muhammad Yahya Patel, a cybersecurity adviser at Huntress. “Your crypto holdings, your investment portfolio, and your pension fund’s exposure to digital assets can all be materially affected by a security failure at an institution.”

But the risk isn’t solely limited to cryptocurrency alone. It seems like the way that the Binance hack came about was through human weakness – the same vulnerability that plagues all businesses, including traditional banks. “Banks, payment providers, cloud platforms: any organisation whose automated systems move money or data on instruction carries the same risk,” says Dave. However, traditional financial institutions like banks have different security systems and arguably more stringent regulatory oversight, which means such a significant amount of capital flight is less likely.

But the more digital finance becomes interlinked with traditional banking, the more complicated the consequences could become. The Financial Stability Board has warned that growing connections between crypto and traditional finance could eventually allow shocks to spill into the wider economy, if they’re not carefully managed and firewalls put in place.

“Banks shouldn’t be watching this thinking it’s a crypto problem,” says Green. “Every institution has engineers with laptops and access to systems that move money.”

At The Independent, our mission is to deliver unbiased, fact-based journalism. Journalism that's free from political allegiances and the influences of shareholders and commercial interests.

But we need your help. Your support enables us to uncover crucial stories that would otherwise have gone untold, hold power to account, and amplify voices often unheard.

Whether $5 or $50, every contribution counts. It fuels our reporting, invests in investigations, and maintains our independence.

It’s a reminder that our trusted, fact-based, free-thinking journalism remains available to everyone thanks to the generosity of our readers. To show your support and help us tell more of the stories that matter, please make a donation today.

Not ready to donate? Choose 'Maybe later' to start reading.