Binance Suffers Record-Breaking $6 Billion Crypto Heist Suspected to Be North Korean Operation

Binance, the world's largest cryptocurrency exchange, has halted withdrawals following a massive security breach that saw hackers steal $6 billion from its digital wallets, marking what is potentially the largest cryptocurrency heist in history. The exchange announced on Friday that it has initiated efforts to recover the compromised assets and is collaborating with law enforcement agencies and blockchain intelligence firms to track the stolen funds.

An initial investigation indicates that the breach originated from an engineer's laptop, which reportedly granted the attacker access to a service container and enabled the submission of unauthorized withdrawal transactions, according to Binance's statement late Thursday. Evidence from blockchain analysis suggests that the hack was orchestrated by North Korea, as reported by several crypto-tracing firms.

A consortium of cryptocurrency firms has managed to freeze approximately $3 billion of the stolen funds amidst an intense effort to locate and secure the remaining digital money. Richard Teng, co-CEO of Binance, stated on X that the attack was a sophisticated operation, not a simple "one-click" exploit. The ongoing investigation has not yet identified any specific individuals or found evidence of a leak of private wallet keys. Binance has assured users that all losses will be covered by the company's funds and its emergency asset fund, emphasizing that "user funds are safe." The exchange temporarily suspended both deposits and withdrawals to facilitate comprehensive security checks and allow blockchain intelligence partners to trace and recover the funds. Binance anticipates that withdrawal services will be reinstated by Sunday morning.

TRM Labs, a crypto-tracing firm, has attributed the heist to an elite North Korean hacking unit, citing "robust on and off-chain intelligence" and noting that "several features of this attack match earlier North Korea-linked heists." Pangolin Intelligence, another blockchain-tracking firm based in Singapore, also expressed its belief that a North Korean hacking unit was responsible for the incident. An analyst from Pangolin Intelligence, who requested anonymity due to privacy concerns, stated that the attribution was based on "analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents." The analyst further commented to CNN, "I think the cat and mouse game has barely begun yet," suggesting that North Korea is likely preparing to utilize its network of money laundering organizations to attempt to liquidate the stolen funds. Chainalysis, another crypto-tracking company, reported that it is monitoring the stolen funds as they move across various blockchains, including bitcoin and ethereum. A Chainalysis spokesperson conveyed to CNN that the firm has "high confidence" that North Korea is behind the hack.

CNN has reached out to North Korea's mission at the UN for comment, though Pyongyang has a history of denying hacking allegations. In previous investigations of significant crypto hacks, the FBI has deployed an on-call team of analysts to assist in freezing stolen funds. The FBI confirmed in a statement on Friday that it is "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps." A spokesperson for the US Secret Service, which also investigates cybercrime, stated that the agency's "investigators are working around the clock with our private-sector partners, including Circle [the company behind the US dollar-backed stablecoin USDC], to identify, freeze, trace, and recover funds stolen from Binance on Thursday. We are also coordinating closely with the United States Attorney’s Office for the District of Columbia and law enforcement partners to identify the cyber criminals responsible and bring them to justice."

If North Korea is indeed identified as the perpetrator, it would not come as a surprise to US law enforcement officials and private sector experts. North Korean hackers were previously implicated in the then-record-breaking crypto hack where they allegedly stole $1.5 billion from Bybit, another major cryptocurrency exchange. In that instance, the attackers absconded with an amount equivalent to a substantial portion of North Korea's reported annual gross domestic product in mere minutes. According to current and former US and South Korean officials, North Korea's sophisticated hacking teams represent a critical revenue stream for the nuclear-armed, sanctions-embattled regime. Reports from the United Nations and private firms indicate that Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms over the past several years. A 2023 CNN investigation highlighted the collaboration between South Korean intelligence services and private crypto-tracking experts to seize approximately $1 million in cryptocurrency that North Koreans had stolen from a victim.

Unlike stock trading platforms, cryptocurrency exchanges typically hold digital assets on behalf of their users, making them more susceptible to hackers and theft, especially given the relatively nascent industry's limited regulatory oversight. Binance was co-founded in 2017 by Canadian national Changpeng Zhao, rapidly becoming the world's largest crypto trading platform within a year of its launch. Zhao stepped down as CEO in 2023 after pleading guilty to violating anti-money laundering laws in the United States. He was subsequently sentenced to four months in federal prison and received a pardon from President Donald Trump in October of the previous year. Zhao, who no longer manages the platform but remains its largest shareholder, stated on X that he anticipates user funds will be fully covered by the exchange, refuting any contrary suggestions in a public exchange on X with Elon Musk. Following the news of the Binance breach, prices for bitcoin and ether, the most actively traded cryptocurrencies, experienced a decline, though they recovered some losses to trade approximately 2-3% lower by midday Friday in Hong Kong.