What to know about the $6.3B hack on Binance, likely the biggest-ever crypto theft - WJHL
Binance, the world's largest cryptocurrency exchange, confirmed Friday that hackers stole more than $6 billion in what appears to be the largest cryptocurrency heist on record.
The company said it has reserved more than $6.34 billion of company funds to cover the stolen assets and was beginning to recover assets for users. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets.
The cryptocurrency exchange has promised to cover all losses, and it has been sharing regular updates on its social media channels as it uncovers more information about the hack.
We are working nonstop to resolve this.
In an exchange Friday with reporters at the White House, President Donald Trump said U.S. officials were investigating the Binance hack. Asked whether North Korea was involved, Trump said: We're looking at that.
North Korean hackers suspected
Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional points of breach.
U.S.-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. We make this judgment with high confidence, the firm said.
An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, TRM said. Several features of this attack match earlier North Korea-linked heists.
Blockchain analysis company Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and CEO Jonathan Levin wrote on X.
Asked about potential ties to North Korea, a Binance spokesperson said only that the company is working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.
Experts have said that North Korea turned to crypto hacking in recent years as a source of foreign currency to support its troubled economy and fund its nuclear program amid tough U.N. sanctions.
Record-breaking theft
While about half of the stolen assets were frozen, there is evidence that hackers already are transferring and converting some of what wasn't recovered, said Garrick Hileman, an independent cryptocurrency analyst.
Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler, he said. You mix it in with other cryptos, and it's harder to track.
Binance's founder, Changpeng Zhao, wrote on X that while Binance's hack might be the largest in terms of dollar value, previous attacks like Mt. Gox had affected more bitcoin.
A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI.
Security failures
The hack has raised questions about why stronger approval controls were not in place, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.
This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet, he said, referring to cryptocurrency wallets that hold users' private keys digitally and are connected to the internet.
Teng confirmed that Binance's own hot wallet was affected. User assets are held under Binance's established security architecture, he said. The vast majority sits in cold wallets — which are offline and used for secure storage — and are only moved into a hot wallet when a user makes withdrawal.
Teng said Binance's tech and security teams are still deep in investigating the hack, noting it was not carried out by one person and that attackers used complex tactics, including a self-destruct mechanism making the investigation more difficult.
Binance has said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.
Related
