Binance Hack: How $6.36 Billion Vanished in 20 Minutes
How a sweeper script and 50 rotating permission slips drained $6.36 billion from Binance in 20 minutes, with Lazarus Group ties and a 54-minute gap.
What happened in the Binance hack?
An attacker compromised a mechanism used to approve customer transfers at Binance and used it to run an automated program, described as a “sweeper,” that drained funds from wallets. The exploit moved $6.36 billion out of the exchange in roughly 20 minutes. The entry point is still disputed, and reporting has pointed to a single engineer’s laptop being compromised as the starting foothold, though it remains unclear whether that was the entire story or just the visible part of it. No private keys were confirmed exposed, and Binance has stated there’s no evidence that core custody systems were breached in the way earlier reporting suggested.
TL;DR
- A compromised transfer-approval mechanism let attackers deploy a sweeper script that emptied wallets automatically, without a human clicking anything during the actual theft.
- The script rotated through roughly 50 permission slips (transaction authorization tokens) because it didn’t know in advance which one would be valid, so it cycled through them until one worked.
- The entire drain took about 20 minutes, while the human security response took around 54 minutes to kick in, a gap that likely cost billions in funds that could otherwise have been frozen.
- Stolen funds were quickly converted into ETH and other assets regardless of exchange rate, and a portion was borrowed against rather than sold outright, both tactics aimed at making the money harder to freeze or trace.
- Chain analysis has linked the laundering patterns to the same actors behind the Bybit hack (around $1.5 billion, February 2025) and the Bitget hack ($38 million), with funds showing signs of comingling.
- All signs point toward North Korea’s Lazarus Group (also called TraderTraitor), though attribution for the Binance incident specifically is still being finalized.
- There’s no confirmed evidence that AI models directly executed the attack. What made it different was the speed and precision of automation, not necessarily artificial intelligence in the generative sense.
Without shadow IT.
How did the sweeper script actually work?
Once attackers gained control of the system that approves outbound transfers, they didn’t need to manually authorize each withdrawal. Instead, they deployed a program built to detect available balances and move them out automatically, continuously, and across many wallets at once. This is the “sweeper” model: a script that watches for liquidity and sweeps it the moment it’s accessible, including new deposits coming in from unsuspecting customers during the attack window.
The tricky part was authorization. Transfers needed a valid transaction identifier, essentially a permission slip, to go through. The attackers didn’t know ahead of time which identifier would be accepted, so the script was built to cycle through something like 50 of them in sequence until it found one that worked, then executed the transfer immediately. This rotation is what allowed the operation to scale: rather than attacking a single approval path, the script brute-forced its way through a set of possible valid paths at machine speed, something no human operator could do manually in real time.
This is also why the incident reads less like a clever one-off heist and more like an engineering exercise. Building a script that can detect, authorize, and move funds across dozens of permission paths without pausing for confirmation takes planning well before the attack starts. The execution itself, once triggered, needed no further human input.
Why did the human response take 54 minutes?
The sweeper script ran for about 20 minutes before the bulk of the theft was complete. Human security teams reportedly took around 54 minutes to recognize what was happening and respond. That means the response came well after the automated draining had already finished its main work, leaving a window where billions moved out of reach before anyone at the exchange could freeze accounts, halt transfers, or coordinate with other platforms.
This gap is the real story here, more than the theft mechanics themselves. Automated systems can execute in seconds what used to take organized human effort over hours or days. Detection and response, by contrast, still largely depends on a person noticing an anomaly, escalating it, and authorizing a countermeasure. When the offense is fully automated and the defense isn’t, the mismatch in speed becomes the deciding factor in how much money gets away.
What happened to the stolen funds?
After the funds were out, the attackers moved quickly to make them harder to recover. Some holdings were converted into ETH and other assets immediately, even at unfavorable exchange rates, because the goal wasn’t profit maximization in the moment, it was making the funds harder to trace and freeze. Other portions were used as collateral to borrow against, a laundering tactic similar to pawning stolen goods: the attacker gets usable liquidity while the original asset stays technically separate from any sale that could be reversed.
| Vendor | Tier | Risk | ApprovalNEW |
|---|---|---|---|
| Northwind Supply | Tier 1 | Low | Approved |
| Acme Logistics | Tier 2 | Medium | Approve |
| Helios Data | Tier 1 | High | Pending |
| Granite Freight | Tier 3 | Low | Approved |
| Pinecrest Labs | Tier 2 | Low | Approve |
Issuers managed to freeze some of the funds after the fact, meaning not all $6.36 billion was permanently lost to the attackers. Estimates following the earlier Bybit and Bitget incidents suggest that out of combined totals in the range of several billion dollars across multiple hacks, the amount that ends up truly unfreezable and usable by the attackers is lower, with figures in the $2.5 to $3.5 billion range circulating for that broader pattern of thefts.
Is this connected to North Korea’s Lazarus Group?
Chain analysis has reportedly found signs of fund comingling between this incident and two earlier hacks attributed to the same actors: the Bybit hack from February 2025, worth about $1.5 billion, and the Bitget hack, worth about $38 million. That pattern, moving stolen funds through overlapping wallets or laundering paths, is consistent with attribution to North Korea’s Lazarus Group, sometimes referred to as TraderTraitor.
If accurate, this would make the group responsible for a combined total in the range of $7 to $9 billion in crypto theft across just these three incidents. That scale, combined with consistent sophistication and an apparent lack of hesitation about attacking major exchanges directly, has made Lazarus one of the most closely watched threat actors in crypto security circles for years.
Was AI actually involved in the attack?
Based on what’s publicly known, there’s no confirmed evidence that generative AI models directly carried out the Binance exploit. What made the attack remarkable was the scale and speed of automation, not necessarily machine learning or agentic AI systems making decisions. A well-built script executing a predetermined plan (rotate through permission tokens, authorize transfers, convert and launder proceeds) doesn’t require AI to be devastating. It requires precision, pre-planning, and a system that can run unattended once triggered.
That said, the broader environment around this hack matters. Security researchers and AI labs have increasingly used large language models to find vulnerabilities at a scale no human team could manage, patching software faster than before. At the same time, that same capability lowers the barrier for sophisticated threat actors to plan and test attack paths faster too. The Binance hack didn’t need AI to execute, but the surrounding arms race between AI-assisted defense and increasingly fast, automated offense is the context in which incidents like this are becoming more common.
Frequently Asked Questions
How much money was stolen in the Binance hack?
Reports put the total at $6.36 billion drained in approximately 20 minutes, though not all of it ended up permanently in the attackers’ control since some funds were later frozen by issuers.
What is a “sweeper” in the context of this hack?
A sweeper is an automated script designed to detect available funds in compromised wallets and immediately transfer them out, including new deposits arriving during the attack, without requiring manual authorization for each transaction.
Why did the attackers need 50 permission slips?
The system required a valid transaction authorization to approve transfers, but the attackers didn’t know in advance which identifier would be accepted. The script rotated through roughly 50 possible authorizations until it found valid ones, allowing transfers to go through at speed.
Is Lazarus Group confirmed to be behind the Binance hack?
Attribution isn’t fully confirmed for this specific incident, but chain analysis has found fund comingling patterns linking it to the earlier Bybit and Bitget hacks, both previously attributed to North Korea’s Lazarus Group (also known as TraderTraitor).
Why did it take 54 minutes for Binance to respond?
The exact cause hasn’t been fully detailed publicly, but the gap reflects the general challenge of human-driven security response trying to catch up to a fully automated attack that had already completed most of its work before detection and escalation occurred.