Almost $9 billion in cryptocurrency has been hacked from exchange company Binance in the largest cyber attack in the cryptocurrency sector's history.
asserted
billion → hack → history
The bulk of the heist unfolded in about 20 minutes, blockchain records show, and 30 or 40 different tokens were affected, including Ethereum, Bitcoin, and stablecoins, according to crypto watchers.
uncertain
tokens → unfold → watchers
So who did it and where has the money gone?
asserted
money → do → it
Who did it and how?
asserted
Who → do → it
The exact culprit behind the heist isn't known, but many analysts have been quick to point the finger at a cyber unit in North Korea, which has previously orchestrated similar hacks.
asserted
which → know → hacks
US blockchain analysis firm TRM Labs said the attack mirrored a 2025 heist at crypto exchange Bybit, which the US Federal Bureau of Investigation attributed to North Korea.
asserted
Bureau → say → Korea
During the attack, hackers manipulated Binance's virtual wallets to empty into hack-controlled ones and from there move the money.
asserted
hackers → manipulate → money
"TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence," the company said on its website.
asserted
company → attribute → website
"We make this judgement with high confidence."
asserted
We → make → confidence
Blockchain analysis company, Chainalysis, agreed with TRM's assessment.
asserted
company → agree → assessment
An initial investigation suggested the breach may have started with a compromised laptop belonging to one of Binance's engineers, which let an attacker gain access to one of its systems and make unauthorised withdrawals, Binance said.
uncertain
Binance → suggest → withdrawals
Later, the company added it had uncovered additional points of breach.
asserted
it → add → breach
The US Cybersecurity and Infrastructure Security Agency (CISA) has previously warned of the threat TraderTraitor posed, saying they had been targeting cryptocurrency companies since 2020.
asserted
they → warn → 2020
"These actors will likely continue exploiting vulnerabilities of cryptocurrency technology firms, gaming companies, and exchanges to generate and launder funds to support the North Korean regime," it said in 2022.
asserted
it → continue → 2022
Binance has said customer funds are safe and it is working to recover $4.2 billion of funds it froze following the attack.
asserted
it → say → attack
"[We have] begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds," it said.
"
asserted
it → begin → funds
The company has already publicly committed to cover losses through company funds in the prior announcement.
asserted
company → commit → announcement
Binance said it had enough money to "cover this incident" and much of it was in the same type of tokens that were stolen.
These include a variety of different cryptocurrencies including Bitcoin and stablecoin.
asserted
These → say → Bitcoin
Cryptocurrencies, like Bitcoin, are a type of digital asset, which can be bought, sold and transferred online.
asserted
which → buy → asset
Most are not issued by a government or central bank, and their value can fluctuate.
asserted
value → issue → government
The Bank of England describes stablecoin as a cryptocurrency backed by a specified asset or collection of assets, which their creator uses to maintain their value.
asserted
creator → describe → value
Coin value can be pegged to currencies, such as USD.
asserted
value → peg → USD
Roughly half of the stolen coins have been frozen by issuers, but TRM estimated roughly $3.4 billion worth of crypto is out of reach.
asserted
worth → steal → reach
Chainalysis's investigators have traced funds stolen from Binance being laundered and shuffled around in an automated process from different destinations to obscure the trail.
"
asserted
investigators → trace → trail
The investigation remains ongoing and we expect the stolen funds to continue moving in the coming days,"it said.
asserted
funds → remain → ?
Binance is like a virtual stock exchange crossed with a bank, but for crypto.
asserted
Binance → cross → crypto
There, people can buy, sell and swap coins, as well as make deposits and withdrawals.
It was founded in 2017 and is the largest exchange in the cryptocurrency space by volume.
asserted
It → buy → volume
Issuers using Binance include Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture.
asserted
Issuers → use → Tether
The exchange operates a secure asset fund for users, a $1 billion bitcoin reserve designed to protect customers in the event of a security breach, according to its website.
uncertain
exchange → operate → website
This isn't the first time Binance has been targeted, as hackers stole $US40 million worth of bitcoin in 2018 and again in 2022 when $US568 million in coins were affected.
asserted
million → target → coins
The Aporia
