North Korean hackers linked to $6.36 billion Binance breach
Security & Exploits ·
Blockchain analysis firm TRM Labs attributes the largest hack in Binance's history to North Korean attackers, according to a Reuters report.
The incident, which occurred October 29, resulted in a total impact of $6.36 billion, with roughly $3 billion in funds frozen onchain and an estimated $3.3 billion still unrecovered. Binance has pledged to cover all user losses through its SAFU fund, a commitment confirmed in reporting from CryptoPotato.
Preliminary investigation points to a compromised DevOps engineer's laptop as the entry point, granting attackers the ability to submit unauthorized withdrawal transactions without leaking private keys directly. A report from WuBlockchain details that the compromise did not involve exposure of private keys themselves, suggesting the attackers leveraged legitimate system access rather than cryptographic theft. Some accounts of the incident also reference exploitation tied to EIP-7702, though the precise technical chain connecting the laptop compromise to the withdrawal mechanism has not been fully disclosed.
In response, Binance suspended deposits and withdrawals following the breach. The exchange has not detailed how the DevOps engineer's device was initially compromised, nor has it specified a timeline for restoring full platform functionality. Eleven distinct sources have covered elements of this cluster, reflecting corroboration across the scale of losses, the frozen-funds figure, and the laptop-compromise theory, even as some details, including the exact attribution methodology used by TRM Labs, remain unconfirmed independently.
What remains unresolved includes the fate of the $3.3 billion in funds not yet frozen, whether additional user accounts or systems were affected beyond the initial breach, and how Binance plans to prevent similar DevOps-level access compromises going forward. The North Korea attribution, if substantiated further, would mark one of the largest state-linked crypto thefts tied to a single exchange to date.