Binance loses about $6.3B in crypto heist, tracers suspect North Korea

Hackers began siphoning around $6.3 billion in cryptocurrencies from wallets belonging to the exchange Binance on Thursday, starting at around 4pm ET. WIRED calls it what appears to be the largest crypto heist of all time. The coins were spread across multiple blockchains.

Binance almost immediately suspended all deposits and withdrawals while it investigates, and says it is working to identify who was behind the breach. The company, along with other crypto firms, says it has so far frozen around half of the stolen funds, which stops the hackers moving the money or cashing it out. Much of the rest may not be possible to freeze.

TRM Labs, a crypto tracing firm, says the majority of the haul was taken in around 20 minutes on October 29. Binance wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were drained and the money sent to multiple addresses controlled by a single attacker. Analysts say the funds came from hot wallets, which are internet-connected wallets exchanges use to handle customer withdrawals.

The attack was prepared well in advance. "Preparation began at least 36 hours before the theft," TRM says in a blog post. One of the attacker's wallets received three small withdrawals during a test period before operations expanded. TRM describes the sequence: early on October 29 the operator deployed a first piece of code and tested it on two wallets; later that day it rehearsed the final version on a third wallet and routed the test funds back to itself; four hours after that rehearsal, the same code was installed on a Binance hot wallet.

Three crypto tracing firms have linked the attack potentially to North Korean hackers. Tom Robinson, chief scientist and cofounder of Elliptic, told WIRED: "We think North Korea is likely responsible." He added that if so, the theft would almost double everything the regime has stolen in crypto to date. TRM Labs and Chainalysis both say TraderTraitor, an elite subset of North Korean hackers, may be behind it. Elliptic has not specifically tied the attack to that group but sees overlaps in the activity. TRM and Chainalysis say their determinations rest on both on-chain and off-chain analysis. Chainalysis says the strongest evidence came when its investigators saw, in real time, funds stolen from Binance commingling with funds from last month's Bitget exploit, which had been attributed to North Korean actors.

Robinson points to further parallels with the Bybit hack, for which the FBI named TraderTraitor as responsible last year (a $1.5 billion theft): Binance says the attack began with a compromised engineer's laptop, and targeting crypto company staff is a TraderTraitor hallmark; the attacker also funded their wallet through Tornado Cash and rehearsed the attack in advance. Rafe Pilling, a senior director of threat intelligence at security company Sophos, said TraderTraitor focuses on larger operations and has in the past developed its own fake applications to get inside organizations.

Neither Binance nor law enforcement officials have named any suspected links to North Korean hackers. Binance did not answer WIRED's questions on the point, and instead pointed to a statement that it will cover all losses and is working with law enforcement to identify who is responsible. The company also said: "Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach."

The money trail is the open question. Around $3 billion was initially frozen, per the article, but those behind the attack could still potentially take away huge sums. Chainalysis says it sees laundering patterns it has not seen before, and that thousands of quickly processed transactions indicate automation to obscure the trail. Robinson puts the frozen amount at around $2.8 billion, or around 44 percent of the total, almost all of it stablecoins. The remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze; it can only be stopped when it reaches an exchange or other service. He expects some to be caught over the coming months but does not expect the frozen share to rise much further.

Key facts

Around $6.3 billion in crypto was taken from Binance wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana; TRM Labs says most of it went in about 20 minutes on October 29.
TRM says preparation began at least 36 hours earlier, with test withdrawals and a rehearsal on a third wallet four hours before the code went onto a Binance hot wallet.
TRM Labs and Chainalysis say North Korea's TraderTraitor may be behind it; Elliptic says North Korea is likely responsible. Binance and law enforcement have not named any North Korean link.
Binance suspended deposits and withdrawals and says it will cover all losses. Elliptic puts the frozen amount at about $2.8 billion (44 percent), mostly stablecoins.
The unfrozen $3.3 billion is mostly Bitcoin, Ether and XRP, which cannot be frozen; Chainalysis sees automated laundering patterns it has not seen before.

Why it matters

WIRED describes this as what appears to be the largest crypto heist of all time. At around $6.3 billion it is far above the $1.5 billion Bybit hack the FBI pinned on TraderTraitor last year. Elliptic's Tom Robinson says that if North Korea is behind it, this single theft would almost double everything the regime has stolen in crypto to date. The speed also stands out: most of the money moved in about 20 minutes, after at least 36 hours of preparation.

Who it affects

Binance and its customers are the direct victims: the exchange suspended all deposits and withdrawals, and says it will cover all losses from the hack. Other crypto firms and exchanges are involved as they help freeze funds. Crypto and decentralized finance companies are what TraderTraitor tends to target; Rafe Pilling of Sophos notes its focus on larger operations and its past use of fake applications to get inside organizations.

How to use it

This is an incident report rather than a product, so there is nothing to install. The useful reading is in the attack pattern TRM describes: test code on small wallets, a rehearsal of the final version, then installation on a hot wallet hours later. Binance says the breach began with a compromised engineer's laptop and later turned up additional points of breach, and Robinson says targeting crypto company staff is a TraderTraitor hallmark. The source does not say when Binance will resume deposits and withdrawals.

How solid is it

The theft itself is reported by WIRED with timing and technical detail from TRM Labs, plus statements from Binance, Elliptic, Chainalysis and Sophos. The North Korea link is firmly hedged: Elliptic says "likely", TRM and Chainalysis say TraderTraitor "may be" behind it, and Elliptic has not specifically tied it to the group. Binance has not confirmed or named North Korea or TraderTraitor, and neither have law enforcement officials. The frozen figure is stated inconsistently: the article says around half and around $3 billion initially, while Robinson says $2.8 billion, or about 44 percent.

Risks and caveats

Not all of the stolen crypto can be frozen. Robinson says the remaining $3.3 billion is mostly Bitcoin, Ether and XRP and can only be stopped if it reaches an exchange or other service; he expects some to be caught in the coming months but not the frozen share to rise much. Chainalysis reports laundering patterns it has not seen before and automation that obscures the trail. Binance's own account has shifted: its first investigation pointed to a compromised laptop, and a later one found additional points of breach. The source does not explain how the laptop was compromised or name the engineer.

“If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”

— Tom Robinson, chief scientist and cofounder of Elliptic, to WIRED