North Korean hackers suspected in record $6.3 billion Binance crypto theft - KBZK News

Binance has confirmed the theft of approximately $6.36 billion from its wallets on ten different blockchains, an event that took place in about 20 minutes. The exchange stated that it is working with blockchain partners to freeze roughly $3 billion in affected assets and has begun the process of recovering funds for users. Deposits remain unaffected, but withdrawals have been suspended and are expected to resume in the next day or two.

A U.S.-based blockchain intelligence firm, TRM, has attributed the attack to TraderTraitor, which it describes as North Korea’s elite hacking unit. The firm stated that it reached this conclusion with high confidence, noting that several features of the attack match earlier North Korea-linked heists, including the $1.5 billion hack of the cryptocurrency exchange Bybit in February last year.

Chainalysis, another blockchain analysis company, also believes the Binance hack was likely carried out by the DPRK group TraderTraitor. The Democratic People’s Republic of Korea is North Korea’s official name. Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions.

In December 2022, South Korea’s spy agency reported that North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets in the past five years, with more than half of the amount stolen in 2022 alone. The agency said North Korea’s capacity to steal digital assets was considered among the best in the world.

Binance’s founder and former CEO, Changpeng Zhao, known as CZ, posted on X that “User funds are safe!” He added that the theft “does look like a hack on Binance.” While he does not manage the company anymore, he stated that as a shareholder, he expects all user funds will be fully covered.

Kok Tin Gan, cofounder and CEO of the cybersecurity firm NyxLab, suggested that the attack may have been facilitated by a single signature that granted the attacker a never-expiring, full-access token to a Binance hot wallet. A hot wallet is a cryptocurrency wallet that holds users' “private keys,” or unique authorizations, digitally and which are connected to the internet.

Binance stated on X that it had “found no evidence of any wallet private key leak” and that it would release more technical details when its probe is complete. The company also said it is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice.