North Korean Hackers Blamed for Record $6.3B Binance Crypto Breach

Hackers working for the North Korean regime have been blamed for a record cryptocurrency heist following a cyberattack at Binance. TechCrunch reports that at least $6.3 billion in crypto was stolen from the company’s wallets, though about half of that amount was frozen as the stolen crypto moved across various blockchains, according to security researchers. The breach is described as the largest known crypto theft in history, but the incident has not been confirmed as resolved and the amount stolen may change.

Binance said its initial investigation found that attackers targeted a compromised Binance engineer’s laptop. According to the company, that access allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Binance said it has seen no evidence that its private keys were leaked, a scenario that could give attackers broad control over the company’s crypto stores.

Binance said it suspended all deposits and withdrawals while its investigation continues. The company said user funds are safe, but TechCrunch notes Binance did not immediately provide proof of that claim and said it would publish an updated proof of reserves after remediation is complete. A Binance spokesperson said about $3 billion had been frozen by industry partners and that the company is working with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze, and recover additional funds.

Security researchers at TRM Labs attributed the breach to North Korean hackers and called it the largest hack in history. TRM described the group, known in cybersecurity circles as TraderTraitor, as focused almost exclusively on stealing crypto from large companies and exchanges. Elliptic also attributed the theft to North Korean hackers and said some stolen funds ended up in the same wallet used in a previous cyberattack on crypto exchange Bitget earlier this year.

The report raises urgent questions about how a single employee laptop could lead to access to systems capable of controlling billions of dollars in funds. TechCrunch notes that compromised software, open source components, malware, and stolen session tokens can all play roles in incidents involving employee devices. Binance did not respond to TechCrunch’s emailed questions about the breach, including whether a third party had audited its network and systems before the hack.