Within about 20 minutes, digital assets worth more than $6.3 billion disappeared from wallets linked to the Binance platform, the largest cryptocurrency exchange in the world. It wasn't just a passing hack; Rather, it is one of the largest thefts in the history of digital assets, and it revealed serious security vulnerabilities in an industry seeking to consolidate its presence within the global financial system.
Estimates from companies specialized in analyzing transactions via Blockchain technology indicate that the attack was carried out by hackers linked to North Korea, while investigations are still underway to determine the precise method that enabled them to penetrate the platform’s systems, access digital wallets, and transfer funds.
The hack started from an engineer's computer
All the details of the attack are not yet clear, but the initial investigation conducted by Binance indicated that a laptop belonging to one of the company’s engineers may have been hacked, before subsequent investigations revealed “additional points of penetration.”
Co-chair of the platform, Richard Teng, said that the attack was complex and was not carried out by one person, noting that the attackers used advanced methods, including a self-destruct software mechanism that made it difficult to determine the path of the hack and its effects.
According to TRM Labs, a company specializing in blockchain intelligence, about $6.36 billion was transferred from Binance wallets across ten blockchain networks, with the bulk of the process being carried out within about 20 minutes.
This speed indicates that the attackers did not just gain access to the systems; They were also able to carry out massive transfers before the breach was contained, which highlights the importance of the oversight and security approval systems that control the movement of digital assets.
The finger of blame points to North Korea
Cryptocurrency analysis companies, including TRM Labs, Chain Analysis, and Elliptic, pointed the finger at the Trader Traitor group, also known as the Lazarus Group, which is linked to North Korea.
TRM Labs said it reached this assessment with a high degree of confidence, based on similarities between the attack on Binance and previous operations attributed to the same group.
North Korea is accused of using electronic piracy and theft of cryptocurrencies as a source of foreign currency, in light of the international sanctions imposed on it. The Trader Traitor group was accused of being behind the hack of the Bybit platform in February 2025, which resulted in the theft of about $1.5 billion, in one of the largest previous robberies in the cryptocurrency sector.
Blockchain analysis companies say that part of the funds stolen from Binance overlap with funds linked to a recent hack of the Bitgate platform, in which the attack was attributed to Pyongyang.
When US President Donald Trump was asked about the possible involvement of North Korean hackers in the attack, he told reporters at the White House that the US authorities were “looking into the matter,” without confirming responsibility.
How to steal currencies whose records cannot be counterfeited?
The irony is that cryptocurrencies are based on “Blockchain” technology, which is a distributed digital record that documents transactions and makes it extremely difficult to manipulate their history, but that does not mean that the money itself is immune from theft.
Cryptocurrencies are not actually stored inside digital wallets, but rather their ownership and movement are recorded on the Blockchain network, while wallets maintain private keys, which are long digital codes that allow their owner to dispose of and transfer assets.
Whoever obtains these keys can transfer funds without having to hack or falsify the transaction log. Therefore, hackers focus on gaining access to private keys or systems that grant the authority to carry out transfers.
Attack methods vary from exploiting software vulnerabilities, using malware, deceiving employees via phishing emails or social engineering methods, which rely on manipulating people to obtain login data or access permissions.
Even offline physical wallets are not immune to risks; The assets of some users of the French company “Ledger” had previously been stolen through malicious software that was included in devices sold through a distributor.
In the case of Binance, Teng confirmed that a hot wallet belongs to the platform; Any wallet connected to the Internet to facilitate withdrawals and transfers was affected by the attack. He explained that the majority of users' assets are kept in cold wallets that are not connected to the Internet, and are not transferred to hot wallets except when withdrawals need to be carried out.
$3 billion frozen
Binance said that it had allocated more than $6.34 billion of the company’s funds to cover the stolen assets, confirming that it had begun work to recover the assets for the benefit of users.
It explained that it was able, in cooperation with its partners, infrastructure companies and digital currency issuers, to freeze about $3 billion in assets affected by the hack. That is, approximately half the amount.
Tether, the company that issued the stable currency USDT, announced the freezing of about $1.57 billion related to the attack, while Circle said it had frozen $800 million.
But freezing funds does not mean actually recovering them, and part of the assets that were not covered by the freeze have already begun to move through digital transactions and transfers, according to analysts.
The difficulty is that hackers can resort to what are known as “cryptocurrency mixers,” which are tools that collect digital assets from multiple sources and then redistribute them, with the aim of hiding transfer paths and complicating determining the source of funds.
They can also transfer stolen assets or use them in transactions with other parties, making them more difficult to trace and recover.
In this context, Stefan Aver, an analyst at Coinhouse, believes that pirates may resort to paying stolen digital currencies to partners in Russia or China, who in turn will hide their illicit source.
Rival platforms are moving to bolster their defenses
The repercussions of the hack did not stop at Binance; Competing platforms rushed to review their security systems and take precautionary measures, at a time when pressure is increasing on the cryptocurrency sector to prove its ability to protect users’ funds, as its integration into the traditional financial system expands.
The Coinbase platform said that it had made modifications to the systems used to store offline cryptocurrency keys, stressing that the step came as a precaution. The Kraken platform also announced that it monitors security incidents in the sector to extract lessons and apply them to its defense systems.
Sector officials called for enhancing the exchange of information between platforms, and developing joint mechanisms for early detection of breaches and rapid response to them.
Star Shaw, CEO of the OKX platform, said that the sector needs an immediate warning system that allows companies to exchange information as soon as a breach occurs, coordinate the response, and cooperate in freezing suspicious funds.
For his part, Chris Perkins, head of the cryptocurrency sector at Franklin Templeton, said that enhancing security has become an urgent necessity so that the sector can achieve its full potential.
These developments come at a time when the Trump administration is working to expand the presence of digital assets within the American financial system, which raises the importance of protecting the platforms and infrastructure that deals with them, given the widening scope of potential risks with the increasing connection of cryptocurrencies to traditional financial institutions.
Market shake-up and questions about the future of security
News of the hack quickly affected cryptocurrency markets; The price of Bitcoin fell by more than 4 percent, while Ethereum, the second largest digital currency, fell by more than 5 percent, before the two currencies recovered part of their losses during Friday trading.
Despite the scale of the operation, officials in the sector ruled out that the incident would cause large-scale losses to the rest of the platforms, expressing their confidence in Binance’s ability to cover the affected assets.
But the incident raised a fundamental question about the extent of the cryptocurrency industry's ability to keep pace with the escalating security risks, especially with the development of hacking methods and the use of artificial intelligence in carrying out attacks.
Andy Ward, senior vice president at Absolute Security, said that cyberattacks of this level are more a matter of timing than a remote possibility, warning that the development of threats and their expansion in scope may lead to greater hacking operations and more severe financial losses.
As for Binance, which says its user base amounts to 335 million, the challenge is not limited to covering financial losses, but rather extends to restoring users’ confidence and proving that the largest platform for trading cryptocurrencies is capable of protecting their assets in the face of attacks of this magnitude.
Facts
Binance hack in numbers
$6.36 billion: The value of assets seized by pirates.
20 minutes: The period during which the bulk of funds were transferred from the platform's wallets.
10 Blockchain networks: The transfer of stolen assets extended to them.
About $3 billion: the value of assets that were frozen with the help of partners in the cryptocurrency sector.
$6.34 billion: The amount of money allocated by Binance to cover stolen assets and compensate users.
$5 billion: The value of the residual assets the company said it holds.
The eyes of major sovereign investors and global financial institutions are turning to the American city of Miami next December, as the Sovereign Wealth Fund Institute (SWFI) hosts the G20 Investment Week and the inaugural Institutional Investors Summit (I20), in conjunction with the G20 Leaders Summit, in an effort to attract more long-term capital to the United States.
The institute announced the invitation of 51 sovereign funds, government holding companies, and public investment institutions from around the world to participate in the events that will be held between December 11 and 15, 2026, at the Trump National Doral Resort in Miami. The invited institutions manage assets of approximately $10 trillion, while the value of their existing assets in the United States exceeds $3 trillion, according to the institute’s estimates.
The list of invited institutions includes the Saudi Public Investment Fund, the Abu Dhabi Investment Authority, the Mubadala Investment Company, and the Qatar Investment Authority, in addition to the China Investment Corporation, the Norwegian Government Pension Fund, the Singaporean “Tamasek” Company, the Kuwait Investment Authority, and other major institutions.
The calls come at a time when the United States seeks to enhance long-term foreign investment flows, as the institute estimates indicate that Gulf countries have pledged to pump additional investments into the American market worth $3 trillion over the next ten years. Taking into account existing assets and future commitments, the institute estimates the size of the investment relationship between these institutions and the American economy at about $6 trillion.
The institute said that the invited funds represent about two-thirds of the total assets managed by sovereign wealth funds in the world, noting that their investments in the United States include stocks, treasury bonds, real estate, infrastructure, and private companies.
The trends of these institutions reflect a shift in global investment priorities, as about a third of their investments over the past year went into the areas of artificial intelligence and related infrastructure, including data centers, computing capabilities, semiconductors, robotics, and the energy needed to operate these technologies.
Investment Week aims to bring together entities seeking financing with institutions capable of providing it, with the participation of pension funds, endowments, family offices, and asset managers, in addition to US state governors and economic development agencies, which will present projects ready for implementation.
Eric Trump, Donald Trump Jr., Zach Witkoff, and Alex Witkoff are scheduled to participate in the events, along with more than ten CEOs of sovereign wealth funds, according to the announcement.
Lakshmi Narayanan Ramanujam, Chairman of the Board of Directors of the Sovereign Wealth Fund Institute, said that the invited institutions already possess US assets worth more than $3 trillion, while the governments behind them have pledged additional investments of the same value, adding that an increasing portion of the new capital is heading to artificial intelligence, computing capabilities, and the energy needed for them.
For his part, Michael Madewell, CEO of the Institute, said that the event aims to bring together those who allocate capital with the companies and projects that need it, in addition to governments and bodies capable of creating the necessary conditions to implement investments.
During the week, the Institute will also host the Round Table of Sovereign Wealth Funds affiliated with the G20 on December 12, while the events include the “i20 Future 100” list, which includes 100 private companies that the Institute believes are likely to attract the attention of sovereign investors during the next decade.
Fitch Ratings Agency has placed French public finances under further pressure, after it lowered the outlook for the country’s rating from “stable” to “negative,” in a move that reflects growing concerns about the path of public debt and the government’s ability to contain the budget deficit, amid an economic slowdown and political and social divisions that hinder efforts to control spending.
The US agency kept France's credit rating at "A+", but warned of the possibility of downgrading it in the future if financial indicators do not improve. It expected the ratio of public debt to gross domestic product to rise from about 115.7 percent in 2025 to 124 percent by 2028, compared to its previous estimates last August, which expected the ratio to reach 122.7 percent.
Fitch said that weak economic growth, renewed deterioration in public finances, and rising bond yields have all increased the difficulty of achieving sustainable fiscal consolidation that stops the upward trajectory of French debt.
The agency's review comes at a time when France is facing increasing pressure in debt markets, as its borrowing costs have risen in recent weeks due to investors' concerns about the sustainability of public finances, in addition to the political and social division that the country is witnessing.
The yield on ten-year French government bonds ended Friday trading at 4.97 percent, compared to 4.91 percent the previous day, after exceeding the 5 percent level last week, in an indication of the high cost of government financing.
A faltering economy and a suspended budget
The latest economic data made the scene even darker, after the National Institute of Statistics and Economic Studies announced that the French gross domestic product contracted by 0.1 percent during the third quarter of the year, contrary to expectations that it would grow by 0.1 percent.
The economy contracted by 0.2 percent in the first quarter, before stabilizing in the second quarter, which means that growth was not achieved during the first three quarters of the current year.
Economy Minister Roland Lescure said that the French economy was “stunted,” admitting that growth had not been achieved in three consecutive quarters.
In parallel, the government is facing difficulty in convincing Parliament to approve the 2027 budget, which aims to reduce spending and reduce the deficit. Fitch believes that the government plan is ambitious, but it expects the fiscal deficit to reach 5.5 percent of GDP in 2027, in light of weaker growth expectations and the possibility that the government will be forced to make concessions during parliamentary negotiations.
The government has confirmed that its goal is to reduce the deficit to 5 percent of the gross domestic product, calling for the approval of a responsible budget before the end of the year. Lescor said that Fitch's assessment confirms the urgent need to restore balance to public accounts, stressing the government's determination to continue the path of public financial control.
The minister warned, in a radio interview, that failure to achieve the financial transformation targeted by the budget would lead the country to a “wall,” indicating the danger of continued deterioration of financial indicators.
Political division hampers debt reduction
Concerns are not limited to economic and financial indicators, as Fitch warned that the continued political division and the difficulty of agreeing on a reliable financial strategy will limit the government’s mission to reduce debt.
These concerns gain additional importance as the presidential elections scheduled for two rounds in April and May of next year approach. The agency said that the prospects for reducing debt after the elections are still unclear, in light of the advance of far-right and far-left candidates in opinion polls, and the accompanying difficulty in reaching consensus on a long-term financial policy.
She added that the political discussions preceding the elections did not significantly enhance her confidence in the country's ability to achieve a sustainable reduction in the deficit, noting that the widespread protests over public services and the high costs of living further complicate the social conditions surrounding financial austerity measures.
France has recently witnessed protests that began with the participation of high school students, then spread to other segments of society in protest against the high cost of living, and included acts of violence that aroused widespread interest. The authorities fear that these protests will turn into a long-term movement, similar to the “yellow vest” protests that the country witnessed between 2018 and 2019.
Despite these challenges, Fitch indicated that France's credit rating is still supported by the size, strength, and diversity of its economy, the strength of its institutions, and its affiliation to the Eurozone, in addition to the solidity of its banking sector.
