What to know about the $6.3B hack on Binance, likely the biggest-ever crypto theft

NEW YORK — Binance, the world's biggest cryptocurrency exchange, said Friday that hackers stole more than $6 billion in what appears to be the largest cryptocurrency heist on record. Blockchain firms have pointed to the attack coming from a North Korean hacking unit.

The company said it has reserved more than $6.34 billion of company funds to cover the stolen assets and was beginning to recover assets for users. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets.

The cryptocurrency exchange has promised to cover all losses, and it has been sharing regular updates on its social media channels as it uncovers more information about the hack.

"We are working nonstop to resolve this," Binance's co-CEO Richard Teng said Friday in a video posted to X.

Here's what we know about the hack, possible North Korean involvement and Binance's investigation.

North Korean hackers are suspected in the attack

Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."

U.S.-based blockchain intelligence firm TRM, in a post on its website late Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.

"An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said. "Several features of this attack match earlier North Korea-linked heists."

Blockchain analysis company Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and CEO Jonathan Levin wrote on X.

Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties.

In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated $1.1 billion in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone. It said North Korea's capacity to steal digital assets was considered among the best in the world.

Many are calling this the biggest crypto theft on record

While about half of the stolen assets were frozen, there is evidence that the hackers already are transferring and converting some of what wasn't recovered, said Garrick Hileman, an independent cryptocurrency analyst.

"Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler," he said. "You mix it in with other cryptos, and it's harder to track."

How long it will take the hackers to turn that into something usable isn't clear, he said. "The bottom line is there are places in the world where you can take your bitcoin and get that converted," Hileman said.

TRM and several other crypto firms and experts have said the hack represents the largest cryptocurrency theft on record.

In February of last year, another cryptocurrency exchange, Bybit, suffered a $1.5 billion hit when it was hacked. The FBI said North Korea and TraderTraitor were responsible for the hack. TRM listed the Bybit hack when it referenced similarities between the Binance hack and previous attacks linked to TraderTraitor.

Binance's founder, Changpeng Zhao, wrote on X that while Binance's hack might be the largest in terms of its dollar value, previous attacks on other companies like the crypto exchange Mt. Gox have had a more substantial impact in terms of the bitcoin amount affected, he said.

Experts warn this scale of hacking could become more commonplace.

"A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward, a senior vice president at Absolute Security. "Cyber threats are becoming more sophisticated and widespread as ever, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines."

Where experts — and Binance — say things went wrong

The hack has raised questions about why stronger approval controls were not in place, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.

"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and that are connected to the internet.

Teng, Binance's co-CEO, confirmed in a nearly five-minute video posted on X Friday that Binance's own hot wallet was affected. "User assets are held under Binance's established security architecture," he said. "The vast majority sits in cold wallets" — which are offline and used for secure storage — "and are only moved into a hot wallet when a user makes withdrawal."

Teng said Binance's tech and security teams are "still deep" in investigating the hack. He said it was not carried out by one person and that the attackers used complex tactics, including a "self-destruct mechanism" that is making the incident more difficult to investigate.

"We are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds," Teng said. "We will do everything within our power to make sure that these bad actors will be held accountable."

Binance has said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.

Contributing: John Seewer