Binance $6.3 Billion Hack: North Korean Hackers Linked to Record Crypto Theft

Binance Estimates $6.3 Billion Impact From Security Breach; Billions in Assets Frozen

Binance, the world’s largest cryptocurrency exchange, estimates that its October 29 security incident had a financial impact of approximately $6.3 billion, potentially making it the largest cryptocurrency theft on record. The exchange’s initial investigation suggests that compromised DevOps employee laptops allowed attackers to access service containers and submit unauthorised withdrawal transactions.

Binance said it found no evidence of wallet private-key exposure. The exchange reported that approximately $3 billion in affected assets had been frozen on-chain through cooperation with blockchain partners. Tether and Circle separately froze approximately $2.4 billion in USDT and USDC connected to the incident.

The exchange temporarily suspended deposits and withdrawals, revoked affected address authorisations and began cooperating with law enforcement. Binance also pledged to cover all customer losses using its SAFU fund and corporate resources. It plans to publish an updated Proof of Reserves after completing the remediation process.

TRM Labs Links Attack to North Korean TraderTraitor Group

Blockchain intelligence firm TRM Labs attributed the attack to North Korea’s TraderTraitor hacking unit, which is linked to the Lazarus Group. The firm said it had high confidence in its attribution. According to TRM Labs, most of the funds were reportedly drained within approximately 20 minutes, involving transactions across 10 blockchains, including Bitcoin, Ethereum, Solana and Tron.

Approximately 18,270 Bitcoin and 233 million XRP reportedly remain untouched in attacker-controlled wallets. Unlike stablecoins, Bitcoin and XRP cannot be frozen directly by central issuers, making recovery more challenging.

Separately, Microsoft Threat Intelligence reported that North Korean groups Jade Sleet, Coral Sleet and Jasper Sleet are increasingly integrating generative AI into their routine cyber operations. Another group, Onyx Sleet, reportedly used AI to create more than 100 customised PDF phishing lures targeting South Korean users.

Key takeaway: Binance’s estimated $6.3 billion security incident could become the largest cryptocurrency theft in history. Although billions in assets have reportedly been frozen, substantial Bitcoin and XRP holdings remain outside issuer-controlled freezing mechanisms.