- Chainalysis and ZachXBT link the $6.3 billion Binance hack to North Korean hackers.
- On-chain evidence connects the stolen Binance funds to a previous $388 million Bitget hack.
- Crypto firms have frozen over $3 billion in stolen assets, but billions remain movable.
North Korea-linked hackers are suspected of carrying out the $6.3 billion Binance exploit, according to blockchain investigator ZachXBT and analytics firm Chainalysis.
They noted that on-chain evidence connects the stolen assets to funds from a previous $388 million Bitget hack.
Links to Bitget Exploit
Chainalysis co-founder and CEO Jony Levin said investigators observed crypto stolen in last month’s Bitget exploit being commingled with funds taken from Binance. The firm expressed high confidence that North Korea was responsible for the Binance incident.
The findings strengthen earlier suspicions raised by ZachXBT, who identified an on-chain connection between the two incidents. In an update, he revealed that funds stolen from the Binance and Bitget exploits were combined at the same address after moving through THORChain.
According to ZachXBT, the Bitget exploit had previously been attributed to DPRK-linked hacking group TraderTraitor, which was also associated with other incidents, including the Kelp DAO exploit. He said the movement of funds suggests the same actor was behind both attacks.
Binance Hack Links to DPRK’s TraderTraitor
Chainalysis assessed that the attack was carried out by TraderTraitor, citing links to previous exploits. The firm also disclosed that industry participants had already frozen over $3 billion of the stolen crypto.
North Korea has repeatedly been accused of using sophisticated hacking operations to steal digital assets. Its hacking groups have been linked to several major crypto thefts, including the $1.5 billion Bybit exploit.
CNN also reported that blockchain intelligence firms TRM Labs and Pangolin Intelligence independently attributed the Binance incident to North Korean hacking groups based on on-chain activity and intelligence connected to previous attacks.
Follow us on X for real-time crypto updates.
How the $6.28B Binance Exploit Unfolded
Blockchain investigator Dickson Wu provided a breakdown of the stolen assets, estimating that Binance hot wallets lost approximately $6.28 billion across eight blockchains.
According to his investigation, approximately $6.07 billion was moved within the first 55 minutes of the attack. The attacker also continued sweeping assets from an Ethereum wallet for another two hours.
Ethereum accounted for the largest portion, with approximately $3.74 billion stolen. Bitcoin followed with 18,270.2 BTC worth $1.47 billion, while the attacker also took approximately $627.5 million in USDT and TRX from Tron.
Other affected assets included 233.5 million XRP worth $296.5 million, 970,522 SOL valued at $96.1 million, and smaller amounts of assets from Arbitrum, Avalanche, and Optimism.
The stolen Ethereum-based assets included $1.87 billion in USDT, $823 million in USDC, $457 million in ETH, and $88.5 million in RLUSD.
Wu estimated that $2.8 billion had been frozen by Tether, Circle, Ripple, Paxos, World Liberty, and Binance. However, a substantial amount of the hack fund remains movable, primarily in Bitcoin and Ethereum.
Binance Says User Funds Are Safe
Binance’s initial investigation indicated that the breach originated from an engineer’s laptop. According to the exchange, the compromised device allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
The exchange said it would cover all losses using company funds and its emergency assets fund, assuring customers that their funds were safe.
Binance also temporarily suspended deposits and withdrawals while conducting security checks. It revoked authorization for the affected address and contacted law enforcement agencies and blockchain intelligence partners to trace and recover the stolen assets.
The incident has triggered a race between the attacker and crypto companies attempting to freeze the stolen funds before they can be moved or converted.
Former X head of product Nikita Bier reacted to the scale of the theft, joking that North Korea’s GDP had just increased by $5.57 billion.
Ultimately, on-chain evidence linking the attack to North Korea makes the Binance incident another record-breaking crypto theft attributed to the country.
Subscribe to our YouTube channel for the latest crypto news.
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
