Binance freezes $3 billion after record $6.3 billion theft attributed to North Korea

A unit known as TraderTraitor, described as North Korea's elite hacking team, is the likely source of a massive theft from Binance. This assessment comes from TRM, a U.S.-based blockchain intelligence firm that analyzed the transaction data.

The attack resulted in the movement of approximately $6.36 billion out of Binance wallets across ten different blockchains. TRM reported that the bulk of these funds was transferred in a span of roughly 20 minutes. This figure marks the largest cryptocurrency theft ever recorded, according to the firm's analysis.

Binance responded to the incident by freezing about $3 billion in affected assets. The exchange stated on Friday that deposits were not impacted by the breach. Withdrawals, however, were suspended and are expected to restart within the next 48 hours. The company pledged to cover all resulting losses for its users.

Initial investigations by Binance suggested a compromised laptop was the entry point. Subsequent reviews revealed additional points of breach. The company noted on social media that its teams are working around the clock to resolve the issue. It is also collaborating with law enforcement partners to identify the perpetrators.

Chainalysis, another major blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, stated on social media that the hack was likely executed by the TraderTraitor group. He identified the group as a Democratic People's Republic of Korea entity, the official name for North Korea.

Experts link these cyber activities to North Korea's economic needs. The country has relied on crypto theft to secure foreign currency to support its economy and fund its nuclear program. These efforts continue under strict United Nations sanctions. South Korean spy agencies previously estimated that North Korean hackers stole $1.1 billion in digital assets over five years, with more than half of that sum taken in 2022 alone.

Changpeng Zhao, the founder of Binance who stepped down as CEO in 2023, commented on the event via social media. He confirmed that the theft appears to be a direct hack on the platform. Zhao stated that user funds are safe and that, as a shareholder, he expects all user funds to be fully covered.

Cybersecurity experts are questioning the approval controls that allowed such a large transfer. Kok Tin Gan, CEO of NyxLab, noted that the attack appears to have used a single signature to grant a never-expiring, full-access token to a Binance hot wallet. These wallets hold private keys and remain connected to the internet. Binance said it found no evidence of a private key leak and plans to share more technical details once its investigation is complete.