Binance says $6.3 billion stolen in suspected North Korea-linked hack

Hackers stole about $6.3 billion from Binance in what may be the largest cryptocurrency theft on record, and blockchain firms suspect a North Korea-linked group was behind it. Binance says it will cover users’ losses.

The theft happened on Oct. 29, when attackers made unauthorised withdrawals from the exchange’s hot wallets, which are connected to the internet. The Associated Press report says blockchain firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit. Binance says it is still working with law enforcement to identify those responsible.

How did the attackers get into Binance’s systems?

Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The company said the laptop may have let an attacker access a service container and submit withdrawal transactions. Binance said it found no evidence that wallet private keys had been leaked, but later said it had found additional points of breach.

Analysis by blockchain firm Elliptic puts the theft at $6.43 billion and says attackers drained wallets across 11 blockchains. The first transfers began around 20:05 UTC on Oct. 29. Binance has not yet published a full account of how the attack worked.

How much of the stolen crypto has been frozen?

Binance said about $3 billion had been frozen on-chain through work with blockchain partners. Its estimate is close to Elliptic’s analysis, which had verified $2.84 billion frozen by Oct. 30. The amounts may differ because tracking and freezing funds takes time, and crypto prices move.

Elliptic says the attackers began moving some of the remaining funds between blockchains and swapping assets. Moving crypto across networks can make it harder to track, but exchanges and token issuers can sometimes block funds they identify as stolen.

Will Binance customers lose money?

Binance says it will cover the losses through its Secure Asset Fund for Users (SAFU), an emergency fund, and company funds. The company said it had set aside more than $6.34 billion and had temporarily paused withdrawals while it checked its systems. Deposits and other unaffected services remained available, according to the company’s update.

Elliptic says evidence points to North Korea-linked actors, but the attribution is not certain. Its analysis says the attackers’ activity resembles earlier thefts linked to the country. Binance has not confirmed who carried out the breach.

The scale makes recovery a major test for the exchange and the wider crypto industry. For customers, Binance’s promise to cover the loss means the key question now is whether it can restore withdrawals safely and stop the stolen funds from being cashed out.

Sources

• Associated Press report — apnews.com