Finance1 min read

North Korean hackers blamed for stealing record $6.3B in Binance breach

By · Via TechCrunch · Published by Everything Blog

In short

Forensic firms TRM Labs and Elliptic tied the historic intrusion to North Korean operatives, observing that portions of the stolen capital flowed into a digital wallet linked to a previous $351 million Bitget heist. An initial corporate inquiry determined that an engineer's compromised laptop granted attackers entry to a service container responsible for submitting withdrawal transactions. Binance insisted that its private keys were not leaked and that customer balances are secure, although all platform deposits and withdrawals remain temporarily halted.

Key points

  • Intrusions directed at major cryptocurrency platforms provide sanctioned regimes with alt…: Intrusions directed at major cryptocurrency platforms provide sanctioned regimes with alternate pathways to bypass international restrictions.
  • Reliance on an individual employee device to reach high-value transactional systems revea…: Reliance on an individual employee device to reach high-value transactional systems reveals significant operational security risks.
  • Prompt blockchain tracking and asset-freezing capabilities can successfully contain a sub…: Prompt blockchain tracking and asset-freezing capabilities can successfully contain a substantial portion of illicit transactions during large heists.

Sources checked by our analysis pipeline: 1

Hackers working for the North Korean regime have been blamed for a record cryptocurrency heist following a cyberattack at crypto exchange Binance. The hackers stole at least $6.3 billion in crypto from the company’s wallets, though about half of that amount was frozen as the stolen crypto traveled across various blockchains, according to security researchers.

The breach is by far the largest known theft of crypto in history, though the incident has not been confirmed yet to be resolved, and the amount of crypto stolen may change.

In a post on X, Binance said its initial investigation showed that the hackers broke into the company’s network after targeting a “compromised” Binance engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Binance said it has seen no evidence of a leak of its private keys, which would grant the hacker near-unfettered control over the company’s stores of crypto.

The crypto exchange — the world’s largest — said it has now suspended all deposits and withdrawals while its investigation into the breach continues.…

Finance