Who was behind the largest crypto heist in history?

Almost $9 billion in cryptocurrency has been hacked from exchange company Binance in the largest cyber attack in the cryptocurrency sector's history. 

The bulk of the heist unfolded in about 20 minutes, blockchain records show, and 30 or 40 different tokens were affected, including Ethereum, Bitcoin, and stablecoins, according to crypto watchers.

So who did it and where has the money gone?

Who did it and how?

The exact culprit behind the heist isn't known, but many analysts have been quick to point the finger at a cyber unit in North Korea, which has previously orchestrated similar hacks. 

US blockchain analysis firm TRM Labs said the attack mirrored a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korea. 

During the attack, hackers manipulated Binance's virtual wallets to empty into hack-controlled ones and from there move the money. 

"TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence," the company said on its website.

"We make this judgement with high confidence."

Blockchain analysis company, Chainalysis, agreed with TRM's assessment. 

An initial investigation suggested the breach may have started with a compromised laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said.

Later, the company added it had uncovered additional points of breach.

The US Cybersecurity and Infrastructure Security Agency (CISA) has previously warned of the threat TraderTraitor posed, saying they had been targeting cryptocurrency companies since 2020.

"These actors will likely continue exploiting vulnerabilities of cryptocurrency technology firms, gaming companies, and exchanges to generate and launder funds to support the North Korean regime," it said in 2022.

Where is the money?

Binance has said customer funds are safe and it is working to recover $4.2 billion of funds it froze following the attack.

"[We have] begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds," it said.

"The company has already publicly committed to cover losses through company funds in the prior announcement."

Binance said it had enough money to "cover this incident" and much of it was in the same type of tokens that were stolen. 

These include a variety of different cryptocurrencies including Bitcoin and stablecoin.

Cryptocurrencies, like Bitcoin, are a type of digital asset, which can be bought, sold and transferred online. Most are not issued by a government or central bank, and their value can fluctuate. 

The Bank of England describes stablecoin as a cryptocurrency backed by a specified asset or collection of assets, which their creator uses to maintain their value.

Coin value can be pegged to currencies, such as USD.

Roughly half of the stolen coins have been frozen by issuers, but TRM estimated roughly $3.4 billion worth of crypto is out of reach.

Chainalysis's investigators have traced funds stolen from Binance being laundered and shuffled around in an automated process from different destinations to obscure the trail. 

"The investigation remains ongoing and we expect the stolen funds to continue moving in the coming days,"

it said.

What is Binance? 

Binance is like a virtual stock exchange crossed with a bank, but for crypto. 

There, people can buy, sell and swap coins, as well as make deposits and withdrawals. 

It was founded in 2017 and is the largest exchange in the cryptocurrency space by volume.

Issuers using Binance include Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture.

The exchange operates a secure asset fund for users, a $1 billion bitcoin reserve designed to protect customers in the event of a security breach, according to its website.

This isn't the first time Binance has been targeted, as hackers stole $US40 million worth of bitcoin in 2018 and again in 2022 when $US568 million in coins were affected. 

ABC/Reuters