Binance’s $6.3 Billion Crypto Heist: TRM Labs Links Attack to North Korea
Technology
Binance, the world's largest crypto exchange, says hackers stole $6.3 billion in assets from its hot wallets. The company says roughly $3 billion has been frozen and that it will cover all losses using corporate funds and its SAFU reserve.
According to Binance, unauthorized withdrawals took place on the evening of October 29. In an update published on October 30, the exchange said attackers had drained approximately $6.3 billion in tokens from its hot wallets. Its initial investigation pointed to a possible compromise of a DevOps engineer’s laptop, which may have given the attacker access to an internal service container. Binance later said investigators had identified additional points of breach. The company said it had found no evidence that wallet private keys were leaked.
Binance and its partners have frozen about $3 billion in assets on-chain. The exchange temporarily suspended withdrawals, strengthened security checks and revoked authorizations associated with affected addresses. To reimburse the losses, Binance set aside more than $6.34 billion in corporate funds, including about $5 billion held in the same tokens that were stolen. Binance maintains that customer funds are safe.
The perpetrators have not been officially identified. However, blockchain intelligence firm TRM Labs attributed the operation, with high confidence, to TraderTraitor, a hacking group linked to North Korea. TRM said the attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the funds transferred in about 20 minutes. Chainalysis separately revised its estimate of the stolen amount to around $5.9 billion at the time of the theft.
The incident has become a major test for security practices and asset-protection systems across the crypto industry. Binance is continuing its investigation with law-enforcement agencies and blockchain intelligence partners. The exchange says it will publish a technical post-mortem after verifying the facts. Its immediate priorities are restoring withdrawals and recovering assets that can still be retrieved.
Binance and its partners have frozen about $3 billion in assets on-chain. The exchange temporarily suspended withdrawals, strengthened security checks and revoked authorizations associated with affected addresses. To reimburse the losses, Binance set aside more than $6.34 billion in corporate funds, including about $5 billion held in the same tokens that were stolen. Binance maintains that customer funds are safe.
The perpetrators have not been officially identified. However, blockchain intelligence firm TRM Labs attributed the operation, with high confidence, to TraderTraitor, a hacking group linked to North Korea. TRM said the attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the funds transferred in about 20 minutes. Chainalysis separately revised its estimate of the stolen amount to around $5.9 billion at the time of the theft.
The incident has become a major test for security practices and asset-protection systems across the crypto industry. Binance is continuing its investigation with law-enforcement agencies and blockchain intelligence partners. The exchange says it will publish a technical post-mortem after verifying the facts. Its immediate priorities are restoring withdrawals and recovering assets that can still be retrieved.
Powered by Froala Editor