We now have the full picture of the Binance hack. And it’s much worse than what was reported last night: $6.3 billion. The biggest theft in the history of cryptocurrency. Four times the size of Bybit’s.

Let me explain what happened, because it’s like something out of a movie.

They didn’t crack any private keys. They hacked the laptop of a BINANCE engineer. From that laptop, they accessed an internal system container and started signing withdrawals as if they were Binance itself. A single transaction targeting one of the hot wallets had 50 signed approvals. The attacker didn’t break into the vault: they sat in the chair of the employee who had the key.

Result: hot wallets were emptied across TEN blockchains at once. 200,630 ETH and 185 tokens on Ethereum, 18,270 bitcoins, 233 million XRP, plus Solana, Tron, Avalanche... Most of the $6.3 billion was gone in just 20 minutes.

The detail that sounds like it was written by a screenwriter: two days earlier, Binance had announced that it had just repelled a campaign by North Korean hackers who used fake job interviews to sneak in malware. They repelled the attack at the front door, and the hackers came in through an employee’s window. Today, TRM Labs and Chainalysis attribute the attack “with high confidence” to TraderTraitor, the North Korean unit of the Lazarus Group. The same people behind Bybit. They’ve quadrupled their own record in 20 months.

The counteroffensive has also been historic: around $3 billion has been frozen in less than 12 hours. Tether blocked more than $1.5 billion, Circle $823 million, Ripple around $200 million in RLUSD, and even Coinbase, Binance’s biggest competitor, offered to help by blocking transfers to the hacker’s addresses. Half the loot is already dead. The other half, in Bitcoin and Ethereum that no one can freeze, is being laundered right now through increasingly smaller transfers.

Binance has suspended withdrawals while it reviews its systems, says users’ funds will be fully covered, and expects to reopen in about 48 hours. That will be the real moment of truth: when they reopen, we’ll see whether trust holds.

And one final thought: the biggest hack in history didn’t compromise cryptography. It compromised a person. The blockchains worked perfectly. The weakest link is still the same as always.