6.3 billion Binance hack likely work of North Korea, blockchain intel firms say

TRM points to North Korean unit

TRM said Thursday that TraderTraitor, which it described as North Korea’s elite hacking unit, was likely responsible for the Binance attack. The firm said it had high confidence in that assessment.

TRM also said several features of the incident resembled earlier heists linked to North Korea, including the Bybit hack. In February last year, Bybit suffered a $1.5 billion loss in a hack, which the FBI blamed on North Korea and TraderTraitor.

Binance suspends withdrawals

Binance said Friday that deposits were unaffected, while withdrawals were suspended. The exchange expected withdrawals to resume within a day or two and said it would cover all losses. On social media, Binance said its teams were working continuously to resolve the issue and cooperating with law enforcement to confirm the criminals’ identities and bring them to justice.

Zhao comments on user funds

Zhao wrote Thursday that user funds were safe, while also saying the theft appeared to be a hack on Binance. He said he no longer managed the exchange but expected user funds to be fully covered as a shareholder.

Zhao described what he believed was a signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. Such wallets hold users’ private keys digitally and are connected to the internet.

North Korea’s crypto theft record

South Korea’s spy agency said in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency and other virtual assets over the previous five years. More than half of that amount was taken in 2022 alone.