Crypto exchange Binance suffers $6.3 billion digital asset theft linked to North Korean hackers

Security Breach

Binance faced a major crisis on Thursday, 29 October, when suspicious transactions triggered an outflow of digital assets worth more than $6 billion from accounts linked to the world's largest cryptocurrency exchange. The company halted deposits and withdrawals, mobilised security teams, and assured customers that it would absorb any losses. The attack began at around 4:20 PM, and senior executives quickly assembled an emergency response team of about 100 employees through the internal messaging platform Wea.

Investigation and Attribution

Blockchain analytics firms Chainalysis and TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group. The FBI also confirmed these findings. Chainalysis chief executive Jonathan Levin noticed the unusual activity during a video call, and teams began tracing transactions on public blockchains. The exchange initially pointed to a compromised laptop as a possible entry point before identifying additional points of breach. Stablecoin issuers Tether and Circle froze more than $2 billion in holdings linked to the attack to limit the damage.

Leadership Response

Binance co-chief executive He Yi coordinated the response from Abu Dhabi while seven months pregnant, joining calls at around 3 AM local time. Founder Changpeng Zhao provided updates to his followers on X and asked Elon Musk to stop public jibes during the fallout. Binance set aside $6.34 billion to cover losses, with He Yi stating that annual revenue and existing reserves were sufficient to absorb the financial hit without selling company shares in SpaceX.

Context

Major cryptocurrency exchanges frequently face sophisticated cyber threats because stolen digital assets can be moved quickly across global blockchain networks. Industry groups often rely on stablecoin issuers to freeze funds and prevent hackers from cashing out intercepted tokens.