North Korean hackers likely steal $6.3 billion from Binance in biggest ever cryptocurrency theft

Binance responds to the hack

Binance said customer deposits were unaffected, but withdrawals were suspended. The exchange expected withdrawals to resume in the next day or two and said it would cover all losses.

Binance said it was working with law enforcement to confirm who carried out the attack and bring those responsible to justice. Former Binance chief Changpeng Zhao posted that user funds were safe and said he expected them to be fully covered.

TRM points to North Korea

Blockchain analysis firm TRM attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. In a post published Thursday, the firm said it made that assessment with high confidence.

TRM said the incident would be the largest cryptocurrency theft on record. A Binance spokesperson said the company was working with law enforcement to confirm the criminals’ identities.

Earlier cryptocurrency thefts

South Korea’s spy agency said in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion US, in cryptocurrency and other virtual assets over the previous five years. More than half of that amount was stolen in 2022, the agency said.

Zhao describes wallet access

Zhao said the theft appeared to involve a hack on Binance. Although he no longer manages the exchange, he said he expected user funds to be fully covered as a shareholder.

He also described what he believed happened: one signature gave the attacker a never-expiring, full-access token to a Binance hot wallet. Such wallets hold users’ private keys digitally and are connected to the internet.