Binance says $6.3B US hacked in what could be largest cryptocurrency theft ever
Binance says in new statement multiple 'points of breach' discovered
uncertain
points → say → breach
A U.S.-based blockchain intelligence firm says a North Korean unit was likely behind the hack that impacted more than $6 billion US on Binance, the world's biggest cryptocurrency exchange.
asserted
that → say → Binance
Binance in a statement early Friday called it a "complex attack" and said it worked with blockchain partners to freeze roughly $3 billion US in affected assets.
asserted
it → call → assets
The cryptocurrency exchange said that deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.
asserted
withdrawals → say → day
It said it will cover all losses.
asserted
it → say → losses
The company said on X Friday that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."
uncertain
investigation → say → breach
Blockchain analysis firm TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit.
asserted
it → attribute → unit
"We make this judgment with high confidence," the firm said.
asserted
firm → make → confidence
"An attacker moved approximately $6.36 billion US out of Binance wallets on 10 blockchains, most of it in about 20 minutes," TRM said.
asserted
TRM → move → minutes
That would make the hack the largest cryptocurrency theft on record, it said.
asserted
it → make → record
In February last year, another cryptocurrency exchange, Bybit, suffered a $1.5-billion hit when it was hacked.
asserted
it → suffer → hit
The FBI said North Korea and TraderTraitor were responsible for the hack.
asserted
Korea → say → hack
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.
asserted
TRM → match → hack
North Korean history of hacks
Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X.
asserted
Levin → believe → TraderTraitor
DPRK stands for the Democratic People's Republic of Korea, North Korea's official name.
asserted
DPRK → stand → Korea
Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."
asserted
company → ask → justice
Experts say North Korea has turned to crypto-hacking and other illicit cyberactivities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough UN sanctions and other difficulties.
asserted
Korea → say → sanctions
In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion US) in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone.
asserted
hackers → say → 2022
It said North Korea's capacity to steal digital assets was considered among the best in the world.
asserted
capacity → say → world
Changpeng Zhao, a Canadian businessman also known as CZ, founded Binance in 2017.
asserted
Zhao → know → 2017
In 2023, he pleaded guilty to a felony linked to failing to prevent money laundering on the platform and stepped down as the company's CEO.
asserted
he → plead → CEO
U.S. President Donald Trump pardoned Zhao in 2025.
asserted
Trump → pardon → 2025
Trump pardons Canadian Binance CEO who failed to stop illegal activity on crypto platform
What we know about ongoing Coldcard hack that's stolen over $100M worth of bitcoin
Zhao posted Thursday on X that "User funds are safe!" but added that the theft "does look like a hack on Binance."
asserted
theft → pardon → Binance
He added that while he doesn't manage Binance anymore, "as a shareholder, I expect all user funds will be fully covered.
asserted
funds → add → shareholder
"
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.
asserted
Gan → raise → NyxLab
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.
asserted
which → look → internet
Binance said on X it had "found no evidence of any wallet private key leak" and that the company would release more technical details when its probe is complete.
asserted
probe → say → details
The Aporia
