Binance hit by $6.3bn hack blamed on North Korean hacking unit

The cryptocurrency exchange Binance says it is working to recover funds after more than $6.3bn (£4.7bn) in digital assets was stolen on 29 October, in an attack that blockchain intelligence firm TRM Labs has attributed to an elite North Korean hacking unit.

Binance, the world's largest crypto exchange, says roughly $3bn of the stolen assets has been frozen on-chain with the help of blockchain partners. It has given no update on the status of the remaining $3.3bn.

Attack began with an engineer's laptop

Co-CEO Richard Teng said in a post on X that the initial investigation suggests the incident started with a compromised DevOps engineer's laptop, which gave an attacker access to a service container where unauthorised withdrawal transactions were submitted. He said the attacker did not simply use one engineer's permissions and that the episode "was not a single 'one-click' action", describing a more complex attack process.

Teng said no individual has yet been attributed responsibility and there is no evidence of a wallet private key leak. He said customers' money is safe and that Binance will cover every loss from its SAFU fund and company funds. Co-founder Yi He also said the company would cover "all hacking losses".

Withdrawals were temporarily suspended while the withdrawal service and related addresses were overhauled, affected address authorisations were revoked, and Binance says it is working with law enforcement and blockchain intelligence partners to trace and recover funds. Deposits are unaffected and operating as normal.

TRM Labs called the breach "the largest crypto theft on record", roughly four times the size of the $1.5bn Bybit hack of February 2025. It said an attacker moved about $6.36bn out of Binance wallets on ten blockchains, most of it within about 20 minutes from 20:05 UTC. TRM said it attributed the attack to TraderTraitor, described as North Korea's elite hacking unit, with "high confidence".

Markets fall

Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker's addresses, freezing more than $2bn of their tokens, according to the media company Decrypt, which reported that the hacker is converting stablecoins, which can be frozen, into ether, which has no issuer able to block it.

Bitcoin fell more than 3% to a six-week low of $76,368 before recovering to $78,335, down 0.6%. Deutsche Bank strategist Jim Reid noted the pressure on crypto assets after Binance suspended deposits and withdrawals. US crypto-linked stocks fell in after-hours trading: Coinbase Global was down 4.8%, while Strategy, a major bitcoin buyer, fell 5.75%.

Teng said Binance would publish a detailed technical post-mortem once the investigation is complete and every fact is verified, along with an updated proof of reserves when remediation is finished.

Source: The Guardian Business.