North Korean hacking group suspected in $6.3 billion Binance theft
publishers 15articles 15first reported 30 Oct, 11:02 UTCdeveloping since 30 Oct · 3 editions
Two blockchain analytics firms have attributed a $6.3 billion cryptocurrency theft from Binance to TraderTraitor, a North Korean state-backed hacking group also associated with the Lazarus Group.
TRM Labs and Chainalysis said they reached their assessments with high confidence, citing on-chain and other intelligence. Chainalysis said funds from an earlier North Korea-linked exploit of the Bitget exchange had commingled with assets stolen from Binance. North Korea has long denied accusations that it uses cybercrime to finance the government.
Binance co-CEO Richard Teng initially said the breach may have begun with a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawals. He later said investigators had found additional points of breach. TRM said the attacker likely gained access to Binance’s hot-wallet signing system.
Binance and industry partners initially reported locating and freezing about $3 billion. A Binance spokesperson later told the BBC that about 80% of the stolen assets had been secured, while the remainder was still unaccounted for.
The theft affected assets across several blockchains, including Bitcoin, Ethereum, Tron and Ripple, according to Chainalysis. Cryptocurrency prices and shares of crypto-linked companies fell after news of the breach, with bitcoin reaching a six-week low and shares of Coinbase and Strategy declining in extended U.S. trading.
HOW THIS STORY WAS MADE
Written from 6 articles, 3 with the publisher's own text; 6 independent newsrooms once syndicated copies count as one; this version written 24 h after the record first saw the story; the editor kept it as written.
- Publishers
- 15
- Source articles
- 15
- Given to the writer
- 6, 3 with the article's own text
- Independent newsrooms
- 6
- This version written
- 24 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →