Binance Reports $6.3B Crypto Theft as North Korea Link Is Suspected
Summary
Binance reported a $6.3 billion cryptocurrency theft and temporarily halted withdrawals. Analysts attributed the attack to North Korea-linked TraderTraitor; about $3 billion was frozen, while the investigation and service recovery continued.
Key points
- Binance restored deposits but was still restricting withdrawals while it overhauled its withdrawal service.
- TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korea-linked hacking unit; Binance said it had not named a suspect.
- Binance said blockchain administrators had frozen about $3 billion; TRM said roughly $2.4 billion remained beyond issuers' control as of early Friday UTC.
- An initial investigation traced access to a DevOps engineer's compromised laptop and a service container, but Binance later reported additional breach points and said the attack was more complex.
- On Ethereum, TRM and Blockaid said the attacker used EIP-7702 and a batch of 50 pre-signed approvals; one enabled a transfer of about $2.5 billion.
- Binance said it found no evidence that wallet private keys had leaked, while Blockaid and Chainalysis said evidence pointed to compromise or misuse of the Ethereum wallet's key.
- Binance said it would cover losses and publish a technical explanation after investigators verify the facts.
Article Details
- Victim Organization
- Binance
- Incident Type
- Cryptocurrency theft involving a breach of Binance systems and unauthorized transfers. TRM said early signs on Ethereum suggested phishing; investigators attributed the attack to TraderTraitor, but Binance has not named a suspect.
- Affected Data Size
- Attackers siphoned approximately $6.3 billion in digital currency. Binance said about $3 billion had been frozen; TRM said approximately $2.4 billion remained beyond any issuer's reach as of early Friday UTC.
- Operational Impact
- Binance restored deposits but temporarily prevented cryptocurrency withdrawals while it overhauled the withdrawal service and related addresses. The company said it would cover losses.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
People
Changpeng ZhaoBinance founder who commented that the incident appeared to be a hack and that user funds were safe.Eric JardineChainalysis head of research who discussed the coordination required to recover frozen tokens.Ido Ben-NatanBlockaid CEO who said the Ethereum wallet's key appeared compromised and that early evidence pointed to misuse of the secret rather than theft of a copy.Jonathan LevinChainalysis co-founder and CEO who said the firm reached the same conclusion about the apparent compromise of the Ethereum wallet's key.Richard TengBinance CEO who said the intrusion involved multiple breach points and was not a single one-click action.
Threat Actors
Vendors
CircleIssuers of stablecoins, tokens pegged to the U.S. dollar, can block transfers from specific addresses. Tether, Circle, Ripple and World Liberty Financial froze holdings in the attacker's accounts.RippleIssuers of stablecoins, tokens pegged to the U.S. dollar, can block transfers from specific addresses. Tether, Circle, Ripple and World Liberty Financial froze holdings in the attacker's accounts.TetherIssuers of stablecoins, tokens pegged to the U.S. dollar, can block transfers from specific addresses. Tether, Circle, Ripple and World Liberty Financial froze holdings in the attacker's accounts.World Liberty FinancialIssuers of stablecoins, tokens pegged to the U.S. dollar, can block transfers from specific addresses. Tether, Circle, Ripple and World Liberty Financial froze holdings in the attacker's accounts.
Products
BinanceCryptocurrency platform Binance restored deposits Friday but is still preventing investors from withdrawing cryptocurrency after attackers siphoned $6.3 billion in digital currency, an amount that makes the incident theEthereumEarly signs on Ethereum suggested a phishing attack, TRM said. Within about half an hour of the first outflow, Binance wallets on Bitcoin, Tron, Solana, the XRP Ledger and several smaller networks sent funds onward in