A major security breach at Binance, the world's largest cryptocurrency exchange, has resulted in the theft of approximately $6.3 billion. U.S. based blockchain intelligence firm TRM has attributed the attack to TraderTraitor, an elite hacking unit operating under North Korea. The firm stated that it makes this judgment with high confidence, noting that several features of the incident align with previous cyber heists linked to the North Korean regime.
According to TRM, the attacker moved roughly $6.36 billion out of Binance wallets across ten different blockchains. The majority of these funds were transferred within a span of about 20 minutes. If confirmed, this event would stand as the largest cryptocurrency theft in history. The scale of the breach far exceeds the $1.5 billion loss suffered by exchange Bybit in February of last year, an incident that the FBI also traced back to North Korea and TraderTraitor.
Binance confirmed the incident on social media, stating that an initial investigation pointed to a compromised laptop as the entry point. However, subsequent reviews uncovered additional points of breach within the system. The company reported that deposits were unaffected during the incident, but withdrawals were temporarily suspended. Binance expects to resume withdrawal services within the next day or two and has pledged to cover all resulting losses for its users.
Chainalysis, another prominent blockchain analysis company, independently assessed the attack. Co-founder and CEO Jonathan Levin wrote on social media that the hack was likely the work of the DPRK group TraderTraitor. The Democratic People's Republic of Korea is the official name for North Korea. Both firms agree that the tactics used in this breach mirror those seen in earlier North Korea linked cyber operations.
In a statement, Binance said its teams are working around the clock to resolve the issue safely and thoroughly. The exchange noted that it is collaborating closely with law enforcement partners to identify the criminals and bring them to justice. The company also stated that it found no evidence of any wallet private key leak, though it plans to release more technical details once its investigation is complete.
Experts suggest that North Korea has increasingly turned to crypto hacking and other illicit cyber activities as a primary source of foreign currency. These funds are critical for supporting the country's troubled economy and financing its nuclear program, especially in light of tough United Nations sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated $1.1 billion in digital assets over the previous five years, with more than half of that amount taken in 2022 alone.
Changpeng Zhao, also known as CZ, who founded Binance in 2017, addressed the situation on social media. Although he stepped down as CEO in 2023 after pleading guilty to a felony related to money laundering prevention, he remains a shareholder. Zhao asserted that user funds are safe and that the incident appears to be a hack on Binance. As a shareholder, he expressed the expectation that all user funds will be fully covered.
Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab, raised questions about the approval controls in place at the time of the breach. He noted that the attack appeared to involve a single signature that granted the attacker a never expiring, full access token to a Binance hot wallet. Hot wallets are connected to the internet and hold the private keys that authorize digital asset transfers.
The incident highlights the ongoing vulnerability of major cryptocurrency platforms to state sponsored cyber actors. While Binance has assured users that their assets are secure, the sheer scale of the theft and the speed at which the funds were moved underscore the complex challenges of securing digital finance against sophisticated adversaries.
