Update, Friday 30 Oct, 6:30 am ET: This developing story has been updated with information from Binance regarding how its system was compromised, and reports from security outlets claiming North Korea may be responsible. These details have been added to the story below.
From hereon, this month shall be called SpookITober. In yet another high-profile cybersecurity incident this month, Binance.com, the world’s largest cryptocurrency exchange, has been hacked, to the tune of $5.6 billion taken in various cryptocurrencies. As of this writing, withdrawals at the exchange are suspended until the company sorts out the situation, though it has stated repeatedly that “user funds remain safe,” adding that it “will cover all losses.” The U.S.-specific Binance.us website is so far reportedly unaffected. At least two security agencies, including TRM, have pinned the attack on an elite North Korean hacking unit.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” the company said in an update on Friday. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.”
“TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit,” the security firm said. “We base this assessment on robust on and off-chain intelligence sources,” continuing to note that the group has been named responsible for a $1.5 billion Bybit hack last year. Per TRM, this latest instance bears many of the same hallmarks as earlier North Korean heists. According to CNN, an unnamed analyst at Pangolin Intelligence corroborated this story by “Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents [involving the North Korean cyber unit].”
Latest Videos FromTom’s Hardware
Preliminary info breaks down the stolen amounts like so: $1.57b in Tether dollars (USDT), $1.45b in Bitcoin (BTC), $875m in Ethereum (ETH), $823m in Circle dollars (USDC), $234m in Tron (TRX), $88.5m in Ripple dollars (RLUSD), $75M in Wrapped-Beacon Ethereum (WBETH), $50m in Tether Gold (XAUT), and $447.5 million in other cryptocurrencies. The “dollar” currencies are all stablecoins, meaning they’re pegged to $1 to represent dollars in the virtual space. Meanwhile, Tether Gold is pegged to the value of one troy ounce.
The stablecoin issuers all moved to blacklist the thief’s main wallet (you can see it here on the Ethereum blockchain) in their smart contracts, a move that means the amounts in USDT, USDC, and RLUSD are frozen in place, totaling around $2.4 billion. It’s possible, but not guaranteed, that the gold-pegged XAUT will also be frozen.
Note that this does not mean those funds have been recovered — the thief simply cannot do anything with those tokens, be it moving or exchanging. Normally in these situations, restitution from the frozen funds happens only after complainants provide proof of ownership, something that usually means copious time spent in courts.
The situation is a lot more grim for the amounts in pure cryptocurrencies like Bitcoin and Ethereum, among others. Since there is no governing entity for their blockchains, the most likely prospect is that the remaining $3.2 billion or so is forever lost in the ether — though some networks incorporate clawback mechanisms. Exchanges may block the thief when he eventually tries to cash out his virtual dough, but historically this hasn’t been a reliable means of recovery.
Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.
Note that this is a developing story, so the tallies are subject to change. Should that amount be final, this heist would exceed the $1.5b stolen from Bybit in February 2025, of which only a paltry portion has so far been recovered. There’s little info so far on the miscreant’s means of larceny. Apparently, the Binance 14 , Binance 16, and Hot Wallet 34 hot wallets, which hold pooled customer funds, were drained. It’s currently not known if this happened via stolen private keys, a compromised signing process, or another type of intrusion.
Binance has assured users that their funds are safe, and most importantly, that it will cover all losses. For what it’s worth, the company has a means of insurance and a reasonable track record in these situations, though the amount of bullion pilfered today is exorbitant.
The company created its SAFU reserve fund in 2018, where it deposits 10% of its trading fees to cover any losses incurred from security issues. That fund currently sits at 15,000 BTC in it (verifiable here), or about $1.17b at the current BTC-USD price of $77,858. SAFU is a cold wallet, meaning its private keys are stored offline.
Back in May 2019, thieves made out with 7,000 BTC from Binance, amounting to around $40 million at the time. The company covered the entirety of the losses with SAFU funds.
However, while $1.17b is certainly a tidy sum, ’tis but a morsel of what currently looks like a multi-billion loss. Binance co-founder, shareholder, and former CEO Changpeng Zhao (CZ) stated in a tweet that he too expects that users will be made whole.
As a final note, Binance is alerting everyone to be on the lookout for contact attempts impersonating the company and/or referencing the current situation. Expect a flood of emails, SMS, and phone scams in the coming months. Be especially wary of any “compensation” or “withdrawal restoration” offers, and never click any e-mail links or otherwise offer any account information — always use the official website or applications yourself directly.
Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
