North Korean hackers may be behind Binance attack involving about $6.3 billion in digital assets

North Korean hackers are suspected of being behind the recent cyberattack on Binance, which affected approximately $6.3 billion in digital assets. For PSPs and crypto operators, the important part is not just the size of the theft: Binance says it has already frozen about $3 billion on-chain, but a significant portion of the funds is still under attacker control.

1. Crypto analytics firms found signs linking the incident to TraderTraitor, a group known for criminal operations against the sector. The attribution has not been confirmed, but Chainalysis said it has a “high degree of confidence” that TraderTraitor is connected to the attack.
2. TRM Labs said the Binance case shares similarities with the $1.5 billion theft from Bybit last year. The firm also said the Binance incident appears to fit the pattern of what The New York Times described as North Korea’s “elite hacking unit.”
3. Binance said it froze about $3 billion on the blockchain in coordination with partners. According to BBC reporting, the company also said it will cover all losses from the SAFU fund and from its own balance sheet.
4. The initial investigation suggests the breach may have started with the compromise of a DevOps engineer’s laptop. Binance co-CEO Richard Teng said the attacker then accessed a service container and used it to send unauthorized withdrawal transactions.
5. Teng said the attacker did not simply use the permissions of one employee, and that this was not a one-click event. He also said the investigation has not assigned responsibility to any individual and has not found evidence of private key leaks from wallets so far.

North Korean hackers, especially groups such as Lazarus and TraderTraitor, are frequently tied to major crypto thefts. Specialists say those operations are used to generate funds for the North Korean regime, which is under international sanctions; the government denies the allegations.