Binance investigates $6.3 billion breach as firms point to North Korea

Binance is investigating a security breach affecting about $6.3 billion in assets, while two blockchain intelligence firms say a North Korean hacking unit was likely responsible. The cryptocurrency exchange says it has frozen roughly $3 billion in affected assets and will cover all losses.

TRM, a U.S.-based blockchain intelligence firm, said an attacker moved approximately $6.36 billion from Binance wallets across 10 blockchains, most of it in about 20 minutes. That would make it the largest cryptocurrency theft on record, the firm said. TRM attributed the attack to TraderTraitor, which it described as an elite North Korean hacking unit. “We make this judgment with high confidence,” it said.

Chainalysis co-founder and CEO Jonathan Levin also wrote on social media that the attack was “likely done by DPRK group TraderTraitor.” DPRK is an abbreviation for North Korea’s official name, the Democratic People’s Republic of Korea. Binance has not confirmed who was behind the incident and says it is working with law enforcement to identify those responsible.

The extent of any unrecovered losses remains unclear. Binance said it worked with blockchain partners to freeze roughly $3 billion on-chain. According to NPR, stablecoin providers Circle and Tether also froze assets linked to the incident. Circle CEO Jeremy Allaire said his company froze the equivalent of more than $800 million in coordination with law enforcement, while Tether CEO Paolo Ardoino said his company froze the equivalent of more than $1.5 billion.

Binance initially said the incident may have involved a compromised DevOps engineer’s laptop that allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It later said its investigation had uncovered additional “points of breach.” The company said it had found no evidence that wallet private keys had leaked and promised more technical details when its investigation is complete.

Binance suspended deposits and withdrawals Thursday while it conducted security checks. On Friday, it said deposits were unaffected, while withdrawals remained suspended and were expected to resume within a day or two. “Our teams are working around the clock to resolve this issue safely and thoroughly,” the company said, adding that it was working with law enforcement to confirm the attackers’ identities.

TRM said several features of the attack matched earlier North Korea-linked thefts, including a $1.5 billion hack of cryptocurrency exchange Bybit. The FBI attributed that attack to North Korea and TraderTraitor, CBS News reported. CBS also reported that cybersecurity executive Kok Tin Gan questioned whether Binance had adequate approval controls, saying the incident looked like “one signature” had given an attacker a “never-expiring, full-access token” to an internet-connected wallet.

Binance founder Changpeng Zhao, who stepped down as CEO in 2023, wrote Thursday that “User funds are safe!” but that the incident “does look like a hack on Binance.” He added that, as a shareholder, he expected all user funds to be fully covered. Binance says it will cover the losses.