North Korea linked to $6.3B Binance hack

A North Korea-based cybercrime group appears to be behind a $6.3 billion hack of the cryptocurrency exchange Binance , according to two blockchain intelligence firms.

Both TRM Labs and Chainalysis tied the largest crypto hack on record to TraderTraitor, a North Korean hacking unit that has previously targeted the digital asset industry.

Billions of dollars’ worth of crypto began moving out of Binance wallets on Thursday afternoon. The company quickly suspended all deposits and withdrawals, and crypto firms froze about $3 billion in assets tied to the incident.

The attacker moved approximately $6.36 billion out of Binance wallets on XRP Ledger, Ethereum, Bitcoin, Tron, Solana and several other blockchain networks, with much of this occurring over the span of around 20 minutes, according to TRM Labs .

While the industry managed to freeze a significant portion of assets, the attacker still controls $2.4 billion “beyond any issuer’s reach,” the blockchain intelligence firm noted.

Chainalysis underscored that once the hack began, the attacker was “in a race against the clock” to swap out freezable assets, like USDT and USDC stablecoins, for nonfreezable assets, like Bitcoin and Ethereum.

“It was only a matter of time before the issuers of those stablecoins would freeze those funds,” it said.

Several aspects of the Binance hack match earlier North Korea-linked incidents, including a $1.5 billion hack of the crypto exchange Bybit last year, TRM Labs noted.

Binance has vowed to cover all losses associated with the incident. It said Friday morning that it has reserved more than $6.34 billion in company funds for this effort.

“Difficult times like this are a great reminder of how strong our industry is when we work together,” Binance co-CEO Richard Teng said in a video posted to the social platform X. “We are grateful to our partners that acted quickly to freeze their assets, to global law enforcement who we are working with hand-in-hand to seek justice.”

“But most of all, we are grateful to our users for their patience and understanding,” he continued. “Rest assured that we are working nonstop to resolve this, to make the users whole and live up to their trust.”