North Korea Fingered in Binance's $6.3 Billion Historic Hack As Withdrawals Resume

Binance, one of the world's largest cryptocurrency exchanges, has recently been impacted by what appears to be the biggest crypto hack in history, leading to a temporary suspension of withdrawal services. Co-CEO Yi He announced that the exchange anticipates restoring withdrawal services within the next 48 hours, with ongoing efforts to improve the withdrawal system and related address controls. Deposits, however, remain unaffected and are operating as usual.

The estimated financial impact of the incident is significant, with Binance putting the figure at around $6.3 billion, while crypto analytics firm Chainalysis estimates it to be $6.4 billion. In response, Binance has assured its customers that all losses will be covered by its Secure Asset Fund for Users (SAFU) and additional company funds, with over $6.34 billion reserved for this purpose. Approximately $5 billion of this reserve is held in the same token assets that were affected, with the remainder being acquired through market and OTC channels.

Binance's preliminary investigation suggests that the security breach could have originated from the compromise of one of its DevOps engineers' laptops. This compromise reportedly granted the hacker access to a service container, from which unauthorized withdrawal transactions were initiated. Despite the extensive breach, the crypto exchange has stated that no leaked wallet private keys have been found so far during the investigation. Authorization for the compromised address has been revoked.

Significant efforts are underway to trace and freeze the stolen funds. Binance has collaborated with blockchain partners to freeze approximately $3 billion of the affected assets on-chain. Stablecoin issuers have also taken action; Tether CEO Paolo Ardoino confirmed freezing over $1.567 billion in USDT, Circle co-founder and CEO Jeremy Allaire froze more than $800 million in USDC, and First Digital CEO Vincent Chok reported that FDUSD stolen in the attack has been frozen. The attacker reportedly attempted to evade these freezes by converting stablecoins into ether and other assets that issuers cannot freeze, swapping $325 million in stablecoins into $285 million in ETH over about 20 minutes, then moving the remaining $175 million to stopover wallets.

Blockchain analysis firms Chainalysis and TRM Labs have linked the record-breaking attack to TraderTraitor, a North Korean hacking group. Chainalysis investigators found that funds stolen in the Binance hack were mixed with crypto associated with a previous Bitget exploit. Jonathan Levin, co-founder of Chainalysis, and TRM Labs both express high confidence in TraderTraitor's involvement, noting the group's association with other major crypto thefts, such as the $1.5 billion Bybit hack. Binance, however, has not yet made an official statement regarding the attacker, as its investigation is still in progress.

The market reacted to the hack with notable declines across cryptocurrencies. Bitcoin dropped toward $76,000 before trading near $77,400, with other cryptos following suit. Total market liquidations reached $1.5 billion, heavily impacting long positions. This sell-off coincided with a separate incident at decentralized betting platform Polymarket, which suspended international trading after hackers drained over $2.6 million from user accounts.

Binance is actively collaborating with law enforcement agencies, including the FBI and U.S. Secret Service, and blockchain intelligence firms to trace the stolen funds and enhance security. The exchange has promised to share a detailed technical report once the investigation concludes and will release an updated Proof of Reserves after completing security enhancements. Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, suggested that the negative price action might continue, expecting a new base to form as more details emerge. Kendrick also posited that the incident could accelerate a shift toward decentralized exchanges. Users are advised to be cautious of scammers impersonating firms like Chainalysis and offering fund recovery services, relying only on official channels for updates.