Crypto platform Binance confirms 'complex' $6.3 bn hack - The Standard (HK)

Blockchain investigation firm TRM Labs expressed "high confidence" that the attack was orchestrated by a North Korea-affiliated group called TraderTraitor, which was also blamed for the $1.5 billion theft from the Bybit platform in February last year. Another analytics firm, Elliptic, attributed the attack to the same hackers.

North Korean Connection

TraderTraitor is believed to be part of Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for "The Interview," a film that mocked North Korean leader Kim Jong Un.

Investigation Progress

Binance confirmed that investigations had "uncovered additional points of breach," contrary to initial findings suggesting the hack involved a single compromised laptop. "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," the company wrote on X.

Customer Impact

Customers' account balances have not been touched, but they cannot move funds off the platform while withdrawals remain suspended. Binance initially suspended all deposits and withdrawals but later clarified that deposits were unaffected. The company said it was on track to resume withdrawals in 45 hours as of 0900 GMT Friday.

Binance warned that the $6.3 billion figure "may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets." The company confirmed that around $3 billion in affected assets had been frozen.

Industry Response

Paolo Ardoino, the boss of Tether, said his firm froze about $1.6 billion "related to a potential Binance exchange hack." Jeremy Allaire, who runs cryptocurrency platform Circle, said his company had frozen more than $800 million in USDC. Both USDT and USDC are "stablecoins" whose value is linked to the US dollar.

President Donald Trump said the United States was looking into the hack, while the FBI stated it was "engaged with relevant public and private partners to understand the scope of the activity" and was ready to investigate.