Binance: $6.3 billion vanishes in 20 minutes. The Lazarus hackers and the rescue of Tether and Circle

On Thursday evening, in the space of about twenty minutes, approximately $6.3 billion in cryptocurrencies was drained from Binance wallets, spread across ten blockchains. It is the largest theft ever recorded in the sector, more than four times the $1.5 billion heist suffered by Bybit in February 2025. According to the exchange’s preliminary investigation, it all began with an engineer’s compromised laptop, from which the attacker gained access to the systems authorising withdrawals.

The response escalated at a dizzying pace: within a matter of hours, around 3 billion of the stolen funds had already been frozen. This was primarily due to Tether and Circle, the companies that issue the two main stablecoins – digital currencies pegged to the dollar. They are able to do this because their tokens contain a feature that allows the issuer to freeze any address. Meanwhile, Binance has suspended withdrawals and announced that it will cover any customer losses by drawing on SAFU, the user protection fund created in 2018 precisely for contingencies such as this.

The sequence illustrates the hallmarks of a well-managed banking crisis: branches closed for a few days and a deposit guarantee to reassure customers. Except that cryptocurrencies were created with the promise of rendering this entire system – from the central bank to the official who freezes an account – completely redundant. The Bitcoin white paper promised a system in which trust in an intermediary would be replaced by cryptographic proof. Eighteen years on, half of the money stolen from the world’s largest exchange was saved by trust in two intermediaries.

Changpeng Zhao, founder of Binance, had already sounded a note of caution back in 2022, following another attack on his blockchain’s bridge, when he wrote that decentralisation was merely a means to an end. The sector has drawn practical conclusions from this, albeit without ever stating them explicitly: Tether freezes funds swiftly and on its own initiative, and for this earns the gratitude of the victims; Circle acts only on the orders of a judge or law enforcement agencies, with its CEO Jeremy Allaire explaining that a private company which freezes funds at its own discretion faces a moral dilemma. The dilemma does indeed exist, even if at the moment everyone is applauding Tether’s swift action. Police powers exercised by a company without a public mandate work as long as the thief is beyond dispute. The day the target becomes a dissident or an inconvenient competitor, that very function could take on a significantly different character.

The story takes on an ironic twist when one considers who the likely perpetrator might be: the analytics firms Trm Labs and Chainalysis attribute the heist, with a high degree of confidence, to TraderTraitor, a unit linked to North Korea’s Lazarus Group. An official attribution has yet to be made, but the pattern is well known: for Pyongyang, cryptocurrency thefts are an essential source of revenue for a nuclear regime strangled by sanctions. The result is a peculiar picture, in which public services – such as the police and insurance – are provided by private companies, whilst the only sovereign state on the scene behaves like a gang of robbers. What is truly baffling, if anything, is why the market has reacted so calmly. Bitcoin lost around 4 per cent, falling to around $77,500, whereas in 2022 the collapse of FTX dragged the entire sector down with it. The difference lies precisely in the fact that this time someone has provided a guarantee: savers have only trusted cryptocurrencies since they were ‘tamed’, that is, to the extent that they have discovered they can rely on a guarantor. Precisely the figure that the system was supposed to do away with. It resembles an old lesson in finance, whereby every innovation ends up reinventing the very bank it sought to escape. We are still waiting to find out who oversees these new bankers. For now, the answer is nobody.