Crypto platform Binance confirms US$6.3bn hack

Cryptocurrency platform Binance yesterday said it was working to resolve a “complex attack” that affected about US$6.3 billion in funds, in what is thought to be the biggest ever crypto heist.

The company — the world’s largest crypto exchange by daily trading volumes — said investigations had “uncovered additional points of breach,” contrary to initial findings that suggested the hack involved a single compromised laptop.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance wrote on X.

The logo of cryptocurrency platform Binance and hacker code are pictured in an illustration yesterday.

Photo: Reuters

Blockchain investigation firm TRM Labs said that it had “high confidence” the attack was orchestrated by a group of hackers affiliated with North Korea called TraderTraitor.

“Several features of this attack match earlier North Korea-linked heists,” TRM said.

TraderTraitor is believed to be part of Lazarus Group — which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong-un.

Binance confirmed on its X account for Latin America that “the total estimated impact is around US$6.3 billion.”

That is four times the amount impacted in the biggest-ever cyberattack of its kind to date: US$1.5 billion taken in February last year from the Bybit platform.

That heist was attributed at the time to TraderTraitor.

Binance said the US$6.3 billion figure “may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.”

About US$3 billion in affected assets had been frozen, it said.

Binance earlier posted a series of sometimes contradictory messages, insisting that “user funds are completely safe,” but also saying it would “cover all losses.”

At about 9am GMT yesterday, Binance said it was on track to resume withdrawals in 45 hours, after announcing earlier that all deposits and withdrawals had been “temporarily suspended.”

“Deposits remain unaffected,” it said.

The company had said on X that initial investigation suggested the hack involved a compromised laptop belonging to a “DevOps engineer,” allowing the unauthorized party to access a “service container” and execute unauthorized withdrawal transactions.

“We have found no evidence of any private key leaks from wallets,” it said, promising to share a detailed technical analysis once investigations were complete.

However, it later said that “subsequent investigation has uncovered additional points of breach.”

Paolo Ardoino, the boss of Tether — a company that issues a cryptocurrency known as USDT — said his firm froze about US$1.6 billion “related to a potential Binance exchange hack.”

Jeremy Allaire, who runs cryptocurrency platform Circle, said his company had frozen more than US$800 million in USDC.

USDT and USDC are both “stablecoins,” or digital currencies whose value is linked to a traditional currency, the US dollar.

The US Department of Justice and the FBI did not immediately respond to requests for comment.