The China Mail - Binance heist: How were cryptocurrency billions stolen?

But how was such a theft possible, and what does it reveal about the security of cryptocurrencies? AFP takes a look.

- Is Binance reliable? -

Binance, the world's largest platform by digital currency trading volume, claims to have 335 million users.

That compares to the reported 741 million cryptocurrency owners worldwide cited by Crypto.com.

However, Binance has faced its fair share of scandals. Its former CEO, Changpeng Zhao, was convicted in the United States in 2024 for violating anti-money laundering laws, though he was later pardoned by President Donald Trump.

It has faced further US legal troubles, including being accused of selling assets that qualify as unregistered securities.

In France, Binance is suspected of having failed to meet its obligations regarding the oversight of client funds.

Having failed to obtain authorisation under the European Markets in Crypto Assets (MiCA) regulation, Binance recently announced a partial suspension of its operations within the European Union.

- A secure technology? -

Cryptocurrencies are based on a technology called blockchain, a digital ledger that records transactions and is designed to make falsification particularly difficult.

Transfers are authorised using "private keys" -- long strings of characters kept secret. However, this does not fully protect funds from theft.

"Even when you think you are using one of the most robust exchanges in the world, it can still be hacked," Stephane Ifrah, an analyst at Coinhouse, told AFP.

- How can hackers still get in? -

To gain access to private keys or the systems that authorise transfers, hackers can exploit a software vulnerability, deploy malicious software, or target individuals -- for instance through phishing.

Some keys are stored on hardware wallets that are not connected to the internet.

However, these devices are not immune to attacks. Funds belonging to users of the French firm Ledger were stolen after malicious components were inserted into devices sold by a third-party retailer.

In the case of Binance, the investigation is pointing toward a "compromised" laptop of one of its engineers, in addition to "points of breach", the platform said on X.

- Who are the hackers? -

While there has been no official confirmation, analyst firms TRM Labs, Chainalysis and Elliptic point to hackers linked to North Korea, specifically the group known as TraderTraitor or the "Lazarus Group".

The amount purportedly stolen is four times the sum that the same hackers -- according to the FBI -- siphoned from the platform Bybit in February 2025.

That theft totalled $1.5 billion, which at the time was the largest ever cryptocurrency heist.

According to Elliptic and Chainalysis, some of the funds stolen from Binance have been traced to the same pool of assets as those taken in a recent hack of the platform Bitget, which the victim attributed to Pyongyang.

- Is it possible to recover the money? -

Binance says that around $3 billion of the affected crypto -- nearly half the total amount affected -- has been frozen with help from issuers and infrastructure partners.

But the freezing of assets does not mean the funds have been recovered.

According to Ifrah, the attackers could employ anonymisation tools, such as cryptocurrency "mixers" or "tumblers", designed to make tracking the stolen assets more difficult.

Binance asserts that it will cover the losses resulting from the hack.

But as Ifrah states, "it is clear that there is no such thing as zero risk".

lul-bcp/ajb/js

T.Luo--ThChM