Binance Hit by $6.3 Billion Hack, North Korea Suspected
On Friday, Binance, the leading global cryptocurrency exchange, announced it was addressing a sophisticated hacking incident, resulting in the loss of approximately $6.3 billion in digital assets, as the company works to mitigate the breach.
Coordinated Response Limits Damage
The company said it coordinated with industry partners, including stablecoin issuers Tether and Circle, to freeze roughly $3 billion of the stolen funds before they could be laundered or cashed out.
Blockchain intelligence firms such as TRM Labs and Chainalysis believe the attack—the largest ever recorded—was carried out by TraderTraitor, a state-sponsored North Korean hacking unit linked to the Lazarus Group.
Binance revealed that investigations uncovered additional points of breach, contradicting earlier findings that suggested the hack involved a single compromised laptop.
“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance wrote on X.
The firm had earlier posted conflicting messages, insisting that “user funds are completely safe” while also stating it would “cover all losses.”
According to AFP, Binance confirmed on its Latin America X account that “the total estimated impact is around $6.3 billion,” which is four times the amount lost in the previous record hack, the $1.5 billion stolen from Bybit in February 2024.
Related Post: Madrid Marine Insurance Hub Lacks Lead-and-Follow Experience
Binance warned the figure “may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.”
The 2024 Bybit heist was also attributed to TraderTraitor, and TRM Labs expressed “high confidence” that the Binance attack was orchestrated by the same group, citing “robust on and off-chain intelligence.”
“Several features of this attack match earlier North Korea-linked heists,” TRM said.
TraderTraitor is believed to be part of the Lazarus Group, which gained international attention in 2014 when it was accused of hacking Sony Pictures in retaliation for “The Interview,” a comedy that mocked North Korean leader Kim Jong Un.
Withdrawals Resume as Prices Drop
At around 0900 GMT Friday, Binance said it was on track to resume withdrawals in 45 hours, following an earlier announcement that all deposits and withdrawals had been “temporarily suspended.”
“Deposits remain unaffected,” the exchange stated.
Initial investigation suggested the hack involved a compromised laptop belonging to a DevOps engineer, allowing unauthorized access to a service container and execution of withdrawal transactions.
Read Also: Anthropic highlights AI safety concerns in filing
“We have found no evidence of any private key leaks from wallets,” Binance said, promising a detailed technical analysis once investigations conclude.
Later, the company acknowledged that “subsequent investigation has uncovered additional points of breach.”
Tether CEO Paolo Ardoino said his firm froze about $1.6 billion “related to a potential Binance exchange hack,” while Circle CEO Jeremy Allaire confirmed his company had frozen more than $800 million in USDC.
Both USDT and USDC are stablecoins, digital currencies whose value is pegged to the U.S. dollar, meaning they typically maintain minimal price fluctuation.
For several hours before Binance confirmed the attack, industry observers reported unusual activity on the platform.
Cryptocurrency prices fell sharply following news of the breach: Bitcoin dropped nearly 5%, Ethereum fell almost 6%, and BNB, the token native to Binance, plunged nearly 10%.
Stablecoins, by design, remained largely unaffected.
