On Thursday, cybercriminals executed a staggering heist, stealing over $6 billion in cryptocurrency, marking the largest theft in this sector’s history, with many investigators pointing towards North Korea as the likely perpetrator.
By Thursday night in the U.S., a consortium of cryptocurrency firms had successfully frozen approximately $3 billion of the misappropriated assets, actively engaging in a race against the hackers to recover the stolen funds.
The breach originated from digital wallets managed by Binance, the largest cryptocurrency exchange globally.
Late Thursday, Binance disclosed that preliminary investigations suggested the breach was facilitated through an engineer’s laptop, which allowed unauthorized access to a service container and the submission of illegitimate withdrawal requests.
On Friday, Richard Tend, co-CEO of Binance, remarked on X that the attack was far from simple, describing it as a sophisticated operation. He emphasized that the investigation has yet to identify any specific individual or any leak concerning wallet private keys.
Binance assured that it would reimburse all losses from its reserves and an emergency asset fund, insisting that “user funds are secure.” The exchange also noted it had “temporarily halted deposits and withdrawals to complete security assessments; revoked authorizations for the affected addresses; and collaborated with law enforcement and blockchain analytics firms to trace and reclaim the stolen assets.”
The magnitude of the incident caught analysts by surprise.
“This is the largest hack ever recorded,” stated Aravind Srinivasan, head of large cryptocurrency market maker GSR’s systematic OTC business, in comments to Reuters.
TRM Labs, a firm specializing in crypto tracking, linked the breach to an advanced hacking unit from North Korea, citing strong on and off-chain intelligence.
Similarly, Pangolin Intelligence, another blockchain analytics company based in Singapore, concurred, also attributing the attack to a North Korean hacking group.
“By analyzing the on-chain activities related to this incident and correlating them with data from past known operations involving the North Korean cyber unit,” an unnamed analyst from Pangolin Intelligence explained, they reached this conclusion.
“I believe the ongoing struggle between entities trying to track these funds has just begun,” the analyst added, hinting that North Korea might leverage a network of money laundering organizations to liquidate the stolen assets.
Chainalysis, another crypto-tracking firm, reported it is monitoring the movement of stolen funds across various blockchains, including Bitcoin and Ethereum. A spokesperson from Chainalysis expressed “high confidence” that North Korea is behind the breach.
CNN has sought a statement from North Korea’s UN mission, although Pyongyang has historically denied any hacking accusations.
The news organization has also reached out to the FBI and the U.S. Secret Service, both of which investigate cybercrime. The FBI has typically deployed an on-call team of analysts to help freeze portions of the funds in previous large cryptocurrency hacks.
If North Korea is indeed confirmed as the mastermind behind this heist, it would not come as a shock to U.S. law enforcement and cybersecurity experts. North Korean hackers were previously blamed for another significant cryptocurrency theft, wherein they allegedly appropriated $1.5 billion from Bybit, another major crypto exchange, which constituted a substantial part of North Korea’s annual GDP in a matter of minutes.
The sophisticated hacking teams of North Korea have become a pivotal financial resource for the country’s isolated, nuclear-capable regime, as noted by numerous U.S. and South Korean officials. Reports from the United Nations and private companies indicate that North Korean hackers have stolen billions from financial institutions and cryptocurrency exchanges over recent years.
A CNN investigation from 2023 outlined how South Korean intelligence collaborated with private crypto-tracking experts to recover roughly $1 million in cryptocurrency stolen by North Korean operatives.
Unlike traditional stock trading platforms, cryptocurrency exchanges typically maintain digital assets on behalf of their users, which makes them more susceptible to hacking incidents, especially in an industry that lacks stringent regulatory oversight.
Binance, co-founded in 2017 by Canadian entrepreneur Changpeng Zhao, swiftly rose to prominence as the world’s leading crypto trading platform within a year.
Nonetheless, Zhao resigned in 2023 after admitting guilt for breaching U.S. anti-money laundering regulations, serving a four-month federal prison sentence before being pardoned by President Donald Trump last October.
Although Zhao no longer operates the platform, he retains ownership as its largest stakeholder, having stated on X that the recent breach appears to be a hacker’s work and that he anticipates full compensation for user funds by the exchange.
Following the announcement of the Binance security breach, the values of Bitcoin and Ether, the two most widely traded cryptocurrencies, experienced a decline but managed to regain some ground, trading about 2-3% lower by midday Friday in Hong Kong.