TRM links $6.36 billion Binance hack to North Korean unit TraderTraitor

Binance suffered a cryptocurrency theft of approximately $6.36 billion, according to a new analysis.

US-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it describes as the elite hacking unit of North Korea. The company stated it makes this assessment with a high degree of confidence. TRM reported that an attacker moved funds from Binance wallets across ten blockchains. The majority of the transfer occurred within 20 minutes. This incident would become the largest recorded theft of digital assets.

Binance announced on Friday that it worked with blockchain partners to freeze nearly $3 billion in affected assets. The platform suspended withdrawals, which are expected to resume within one to two days. The company stated that deposits were not affected. Binance said it will cover all losses incurred by users.

The exchange provided initial details on social media on Friday. It reported that an early investigation suggested a compromised personal computer was involved. Later inquiries found additional vulnerabilities. Binance said it did not find evidence of leaked private wallet keys. The company plans to publish more technical details when its investigation concludes.

Chainalysis also analyzed the event. Jonathan Levin, the cofounder and chief executive of Chainalysis, wrote on X that the hack was likely carried out by the DPRK group TraderTraitor. He used the official abbreviation for the Democratic People's Republic of Korea in his post.

A Binance spokesperson told reporters that the company is working closely with security partners. The goal is to confirm the identity of the criminals and bring them to justice. The company did not offer a definitive statement on North Korean involvement in that initial communication.

Cybersecurity experts raised questions about the firm's internal controls. Kok Tin Gan, cofounder and CEO of NyxLab, noted that the attack suggests weak access restrictions. He said a single signature apparently gave the attacker a full-access token to a Binance hot wallet. The token did not have an expiration date. Hot wallets store private keys and remain connected to the internet.

This theft follows a $1.5 billion hack at Bybit in February of last year. The FBI previously linked that incident to North Korea and TraderTraitor. TRM noted that several features of the Binance attack match those prior thefts. South Korea's intelligence agency estimated in December 2022 that North Korean hackers stole $1.1 billion in digital assets over five years. Changpeng Zhao, who founded Binance in 2017, posted on X that user funds are safe. He added that the incident does appear to be a hack of the platform.