Binance hit by $6.3 billion crypto heist: North Korean hackers suspected

The world's largest cryptocurrency exchange said its initial investigation suggested that the breach may have originated from a compromised laptop belonging to a DevOps engineer, allowing an attacker to gain access to a service container and submit unauthorised withdrawal transactions.

"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions," the exchange said in a statement.

However, Binance said it had found no evidence of any wallet private key being leaked during the incident.

"We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," the statement added.

The exchange estimated the total financial impact at around $6.3 billion, adding that it had been working with blockchain partners to freeze the affected assets.

"We have worked with blockchain partners to freeze affected assets, with approximately $3 billion frozen on-chain so far," Binance said.

Assuring users that their funds remained safe, the company said it would cover all losses through its Secure Asset Fund for Users (SAFU) and its own funds.

"Binance will cover all losses from the SAFU fund and the company's funds," it said.

"Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," the exchange added.

Sharing further details about the incident, Binance co-CEO Richard Teng wrote on X that the initial investigation pointed to a compromised DevOps engineer's laptop as the possible starting point of the attack.

He explained that the breach gave the attacker access to a service container, from where unauthorised withdrawal transactions were submitted.

"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng said, suggesting that the incident involved a more complex attack process.

He also stressed that the investigation had not attributed responsibility to any individual and that there was, so far, no evidence of a wallet private key leak.

Steps taken by Binance

Binance said it had taken several immediate measures to contain the incident and strengthen its security infrastructure.

These include:

Temporarily suspending withdrawals while upgrading the security of its withdrawal service and related addresses.

Revoking authorisations associated with the affected addresses.

Working with law enforcement agencies and blockchain intelligence firms to trace and recover the stolen funds.

North Korean hackers suspected

Meanwhile, cybersecurity and cryptocurrency intelligence experts have pointed towards North Korea as the possible source of the attack.

Blockchain intelligence firm TRM Labs attributed the incident to TraderTraitor, an elite North Korean hacking unit, citing what it described as robust on-chain and off-chain intelligence.

"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence," the firm said in a statement.

TRM Labs added that it was tracking the movement of funds and alerting industry partners through its Beacon Network.

Singapore-based blockchain tracking firm Pangolin Intelligence also said it believed North Korean hackers were behind the incident.

An analyst with the firm, who requested anonymity, told CNN that the assessment was based on an analysis of on-chain transactions and comparisons with previous attacks linked to the North Korean cyber unit.

"I think the cat and mouse game has barely begun yet," the analyst said, adding that North Korea was likely to use a network of money-laundering organisations to convert the stolen cryptocurrency into cash.