Binance

An estimated $6.3 billion left Binance wallets across 10 blockchains, most of it in about 20 minutes, in a theft TRM Labs and Chainalysis attribute to North Korea's TraderTraitor. The attackers held transaction signatures before the theft began; how they obtained them, the source does not say. At least 36 hours of preparation bought twenty minutes of execution. When signatures are the boundary, whoever holds them owns the vault.