Binance, the world's largest cryptocurrency exchange, suspended all withdrawals after suffering what analysts and outlets across the globe are calling the largest heist in the short history of digital assets — an estimated $6.3 billion theft carried out in roughly 20 minutes. The exchange confirmed the breach and said it had frozen a substantial share of the stolen funds, but the episode has already exposed the fragility of the infrastructure that underpins a multi-trillion-dollar market.

Binance put the "estimated total impact" of the hack at about $6.3 billion, according to Ars Technica. Around $3 billion of affected assets — mainly stablecoins that function as cash for the crypto economy — had been frozen by the company and its partners. Reporting from MSN and other syndicated outlets confirmed the exchange's statement that withdrawals were halted as a precaution while investigators traced the movement of funds.

Gone in 20 minutes

Reuters framed the story around its speed, headlining its account "Gone in 20 minutes: How the biggest heist in crypto history unfolded." The compressed timeline is central to the story: the attacker did not need to compromise a vault in the physical sense but rather the digital pathways that authorize transfers, and the withdrawal window closed almost as soon as the anomaly was detected.

Numbers varied slightly by outlet and currency. TechCentral in Ireland reported the loss as €5.6 billion; a Yahoo Finance headline circulated a $5.6 billion figure before converging on the broader $6.3 billion estimate; CNBC and local television affiliates such as WHAS11 rounded to "$6 billion." The discrepancies reflect the chaotic first hours of any large breach, when exchange statements, on-chain analysis and market pricing of volatile assets are all still moving.

The freeze — and the race to unfreezable assets

The most consequential detail may be what the hackers did next. Analysts at Elliptic, the blockchain intelligence firm, said the attacker had already converted about $3.3 billion into digital assets that could not be frozen — principally tokens that, unlike stablecoins, have no central issuer able to blacklist addresses — and was working to cash those holdings out into traditional currency.

The distinction matters enormously. Stablecoin issuers such as Tether and Circle retain the technical ability to freeze balances on their networks, and reports indicated that fears of the Binance hack prompted the two firms to freeze more than $1.5 billion in funds combined. That intervention is the main reason roughly half the haul may ultimately be recovered or at least immobilized.

"Around $3 billion of affected assets, mainly stablecoins that act as cash for the crypto market, had been frozen" — but the attacker "had changed about $3.3 billion into digital assets that could not be frozen."

The split illustrates a structural asymmetry in crypto security: defenders can only freeze what is centrally issued, while attackers can launder the rest through decentralized exchanges, mixers and bridges. Elliptic's assessment suggests the recovery effort is now a race between blockchain forensics teams flagging addresses and the attacker converting them into untraceable value.

North Korea blamed

Multiple outlets — including MSN syndications, the New York Post, Yahoo Finance and Bloomberg — reported that suspicion had fallen on state-linked North Korean hacking operations. Bloomberg's headline, "Binance Heist Shows Power of Suspected North Korean Hackers," framed the breach less as a criminal caper than as a geopolitical capability demonstration. The New York Post went further, describing it in its headline as the "largest bank heist in human history."

Pyongyang has long been accused of funding its weapons programs through cryptocurrency theft, with groups tracked by Western governments and private researchers linked to a string of major exchange and bridge compromises. Past incidents — the 2022 Ronin bridge theft of roughly $620 million and the 2021 Poly Network exploit of about $611 million — established a pattern that investigators say this attack dwarfs.

How different outlets told the story

• Wire services (Reuters, Bloomberg): Focused on mechanics, timing and attribution, treating the hack as a systemic risk event and a window into offensive cyber capability.
• Business and tech press (Ars Technica, CNBC): Emphasized the freezing dynamics, the stablecoin split and the exchange's operational response.
• General-audience broadcasters (BBC World Business Report, local TV affiliates): Rounded figures to $6 billion and led with the simple, startling fact of the scale.
• Tabloids (New York Post): Leaned on the "largest bank heist in human history" framing and the North Korean angle.

The New York Times, for its part, led plainly with the operational fact — "Binance Suspends Withdrawals After Crypto Hackers Steal $6.3 Billion" — a reminder that for most readers the immediate question was whether their own funds were accessible.

Why it matters

Binance's dominance means a halt in withdrawals ripples outward. Traders across venues rely on the exchange for liquidity and settlement; a freeze can trigger cascading margin calls and price dislocations. The fact that stablecoins — the market's de facto settlement layer — bore the brunt of the frozen assets underscores how much of crypto's plumbing depends on a handful of issuers with the power to freeze accounts on command.

That centralization is a paradox for an industry built on the promise of censorship resistance. The same mechanism that allowed Tether and Circle to immobilize billions is precisely the kind of authority crypto's founders sought to eliminate. Recovery, in this case, depended on exactly the intermediaries the technology was designed to bypass.

For regulators, the heist is likely to accelerate demands for stricter custody rules, mandatory incident reporting and coordinated sanctions enforcement against exchange addresses linked to state actors. For Binance, the test is trust: whether users treat a 20-minute breach as a survivable operational failure or as a signal to move assets elsewhere. The exchange has promised a full account of the incident, but as of publication, withdrawals remain suspended and the investigation continues.