Binance says US$6.3b impacted as crypto reels from hack; North Korea said to be behind attack - The Straits Times

Binance has temporarily suspended all deposits and withdrawals following the massive security breach, assuring customers that "user funds are safe." The exchange has worked with blockchain partners to freeze affected assets, with approximately US$3 billion frozen on-chain so far.

Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, North Korea's elite hacking unit, based on "robust on and off-chain intelligence." The firm stated it made this judgment "with high confidence."

This hack surpasses the previous largest publicly known crypto theft at Bybit in February 2025, where attackers made off with nearly US$1.5 billion in tokens. The incident has sent shockwaves through an industry that had been experiencing a two-month price rebound.

Market Impact

Bitcoin slumped 3% at the end of the US session and an additional 3% during Asian trading, falling below US$77,000 to its lowest level since September. Other digital tokens also experienced significant sell-offs.

Industry Response

Stablecoin issuers Tether and Circle moved quickly to freeze missing currency. Tether's CEO Paolo Ardoino reported freezing more than US$1.5 billion of the stablecoin "related to a potential Binance exchange hack," while Circle's Jeremy Allaire said US$800 million of its coin had been frozen amid "reports of a potential exploit involving Binance."

Binance's Secure Asset Fund for Users (SAFU), established in 2018 as an emergency insurance and reserve fund for customers in "extreme situations," is generally maintained at around US$1 billion but has fluctuated with market movements.

Sentiment was already fragile after recent security incidents including hundreds of millions drained from Bitget and tampering with Ledger devices leading to millions in losses.

Broader Context

The hack occurred on the same day that Polymarket halted trading on its international exchange for an hour after a third-party software provider was compromised, resulting in more than 700 users losing US$2.7 million.

Recent security incidents extend beyond crypto firms, with South Korea's Daishin Securities disclosing a data leak affecting 38,000 customers and Mirae Asset Global Investments reporting a hacking incident. In Japan, hackers threatened to release trader data from a GMO Internet Group cloud service.

The incident comes as traders brace for US$11 billion in crypto options set to expire on October 30, and days before the US midterm elections that could lead to greater regulatory scrutiny if Democrats retake control of Congress.