North Korea Linked to $6.3B Binance Hack

Residents of Central Indiana and investors worldwide saw withdrawals suspended from Binance on Friday as the company began recovering assets after a massive security breach. The world's largest cryptocurrency exchange confirmed that deposits remained unaffected during the disruption. Binance stated that withdrawals are expected to resume within the next day or two. The company promised to cover all losses associated with the incident.

Binance initially reported on its X account that an early investigation pointed to a compromised laptop. However, the exchange later disclosed that it found additional points of breach. The company froze roughly $3 billion in affected assets with the help of blockchain partners. Binance said it found no evidence of a wallet private key leak and plans to share more technical details once its probe concludes.

The attack unfolded over a short period on October 29. Analysts from the U.S.-based blockchain intelligence firm TRM stated that an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains. Most of that money was transferred in about 20 minutes. TRM identified the attackers as TraderTraitor, a unit it described as North Korea's elite hacking group. The firm said it made this judgment with high confidence. This event marks the largest cryptocurrency theft on record.

Chainalysis, another blockchain analysis company, agreed with the assessment. Co-founder and CEO Jonathan Levin wrote on X that the hack was likely done by the DPRK group TraderTraitor. The acronym DPRK stands for the Democratic People's Republic of Korea, the official name of North Korea. TRM noted that several features of the attack matched earlier North Korea-linked heists, including the $1.5 billion Bybit hack in February of last year. The FBI attributed the Bybit incident to North Korea and TraderTraitor.

Binance spokespersons said the company is working closely with law enforcement partners to confirm the identity of the criminals. Founder Changpeng Zhao, known as CZ, posted on X that user funds are safe. Zhao, who stepped down as CEO in 2023 after pleading guilty to a money laundering felony, said the theft looks like a hack on Binance. He added that as a shareholder, he expects all user funds to be fully covered. President Donald Trump pardoned Zhao in 2025.

Cybersecurity experts say North Korea has turned to crypto hacking to support its economy and fund its nuclear program. This activity has increased in response to tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers stole 1.5 trillion won, or $1.1 billion, in cryptocurrency over the previous five years. More than half of that amount was stolen in 2022 alone. The agency described North Korea's capacity to steal digital assets as among the best in the world.

Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, raised questions about approval controls. He said the attack appears to have involved a signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Hot wallets are connected to the internet and hold users' private keys. Gan stated that this single token allowed the attacker to move the funds. Binance continues its investigation while managing the recovery process for its users.