North Korea Linked to $6 Billion Binance Hack, Largest Crypto Theft Ever

A U.S.-based blockchain intelligence firm has attributed a massive hack impacting over $6 billion on Binance, the world’s largest cryptocurrency exchange, to a North Korean elite hacking unit. The attack represents the largest cryptocurrency theft on record, with attackers moving approximately $6.36 billion out of Binance wallets across ten blockchains in roughly 20 minutes.

TRM Labs identified the perpetrators as TraderTraitor, which it described as North Korea’s premier hacking unit. “We make this judgment with high confidence,” the firm stated in a post Thursday. Blockchain analysis company Chainalysis corroborated this assessment, with co-founder Jonathan Levin confirming on X that the hack was “likely done by DPRK group TraderTraitor.”

Swift Response and Asset Recovery

Binance moved quickly to contain the damage. The exchange said it worked with blockchain partners to freeze roughly $3 billion in affected assets and began recovering funds for users Friday. Deposits remain unaffected, though withdrawals were initially suspended and expected to resume within a day or two. Most importantly, Binance committed to covering all losses.

The company’s initial investigation suggested a compromised laptop may have been the entry point, but subsequent probing uncovered additional breaches. This wasn’t a simple one-vector attack but rather a sophisticated infiltration with multiple points of access.

Former Binance founder Changpeng Zhao, known as CZ, reassured users through X that “User funds are safe!” while acknowledging the theft appears to be a legitimate hack. Though he no longer manages the company, Zhao stated that as a shareholder, he expects all user funds to be fully covered. This commitment matters given Infeeds reports on crypto security breaches have shown companies sometimes struggle to follow through on such promises.

The Pattern of North Korean Cyber Crime

This incident fits a troubling pattern. Just one year earlier, in February, cryptocurrency exchange Bybit suffered a $1.5 billion hack that the FBI also attributed to North Korea’s TraderTraitor unit. The similarities between the two attacks suggest a deliberate operational playbook refined through repeat offenses.

North Korea has increasingly turned to cryptocurrency hacking as a critical revenue source. Facing crippling international sanctions and struggling with economic hardship, the regime has weaponized its hacking capabilities to fund its nuclear program and prop up its faltering economy. South Korea’s spy agency reported in December 2022 that North Korean hackers stole approximately 1.5 trillion won ($1.1 billion) in cryptocurrency over five years, with more than half occurring in 2022 alone.

Security Questions Linger

Cybersecurity experts are asking uncomfortable questions about preventative measures. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, suggested the breach may have stemmed from a single signature that granted attackers a never-expiring, full-access token to a Binance hot wallet. Hot wallets, which hold private keys digitally and connect to the internet, represent inherent security vulnerabilities.

Binance denied any private key leaks and promised to release technical details upon probe completion. Yet the mere possibility that one compromised credential could grant permanent unrestricted access to billions in assets raises serious questions about enterprise authentication protocols in the crypto industry. This incident demands the kind of security reevaluation the sector has needed for years.

When a single laptop compromise can lead to a $6 billion theft, the industry’s security culture requires fundamental transformation.

Source: NPR