North Korean group suspected in $6.3 billion Binance crypto theft

Resident investors and digital currency holders in Anchorage and across the state watched as Binance paused withdrawals on Thursday following a massive theft. The exchange confirmed that $6.3 billion in cryptocurrency was stolen, marking the largest single financial heist in recorded history.

The initial phase of the attack lasted approximately 20 minutes. Third-party cybersecurity firms examined public blockchain data to determine the speed of the transfer. Binance stated that its internal investigation initially pointed to a compromised engineer’s laptop, though the company later indicated additional breaches occurred during the incident.

Richard Teng, the CEO of Binance, described the operation as complex in a social media video. He noted that the attackers used a self-destruct mechanism to destroy tools and digital traces as they moved through the system. This tactic made it difficult for security teams to trace the intrusion path.

Two cybersecurity firms attributed the hack to TraderTraitor, a North Korean state-sponsored group. Chainalysis reported that stolen funds from Binance mixed with money from a separate $388 million theft of another exchange last month. TRM Labs estimates that North Korean hackers have stolen $12.8 billion in cryptocurrency since 2017.

In the hours after the theft, digital currency issuers moved to lock down the stolen assets. Circle and Tether froze approximately $971 million and $825 million in their respective stablecoins, respectively. Binance said partners have since frozen about $3 billion of the total sum. However, TRM Labs reported that at least $2.4 billion in non-freezable cryptocurrencies remains beyond issuer control.

Binance stated Saturday that it has set aside funds to cover 90 percent of the loss and committed to covering the remaining 10 percent. The company will use its own reserves and a $1 billion bitcoin emergency fund to make customers whole. The exchange continues to conduct security checks before resuming normal operations.

The U.S. Secret Service confirmed it is working with private-sector partners to trace and recover the funds. Thomas Lynch, a Secret Service spokesman, said investigators are working around the clock to identify the stolen assets. Binance is coordinating with global law enforcement agencies as the investigation proceeds.