North Korea Blamed For $6.3 Billion Binance Heist: “Stole 19% Of Its Yearly Income In 20 Minutes”

Summary:

• North Korea stole 19% of its yearly income in about 20 minutes.
• Bitcoin plunged to a six-week low of $76,348
• Reuters Puts Theft Figure At $6.3 Billion 
• TRM Labs and Chainalysis Blame North Korea “Elite Hackers” 
• Crypto Rattled By Binance Hack; Tether, Circle Freeze Billions In Stablecoins

North Korea Gets Binance Hack Blame 

Blockchain analysis firms TRM Labs and Chainalysis have high confidence that North Korea was responsible for the brazen hack of Binance, with the latest figures reported by Reuters putting the theft at around $6.3 billion.

Rand Group wrote on X, “BINANCE HACK: North Korea stole 19% of its yearly income in about 20 minutes.”

The world’s biggest cryptocurrency exchange pledged to cover customer losses using its protection fund and company resources. About $3 billion of the stolen assets had been located, with roughly half the haul frozen by stablecoin issuers including Tether, Circle and World Liberty Financial.

“TRM attributes the attack to … North Korea’s elite hacking unit,” the US blockchain intelligence firm said. Both TRM and Chainalysis said they were highly confident North Korea was responsible, according to the Reuters report.

Bitcoin plunged to a six-week low of $76,348 late Thursday night, down from $81,877 around lunchtime in New York earlier that day. That’s a decline of about 6.8%.

Crypto-linked stocks were clobbered in premarket trading. Hut 8 and Galaxy Digital each fell 7%, while Cipher Digital dropped nearly 7%. Robinhood Markets and Strategy each slid 6%, Riot Platforms lost 5.9%, CleanSpark declined 5.7%, and MARA Holdings fell 5.5%.

Aravind Srinivasan at market maker GSR described the Binance hack as “the biggest hack in history.”

Canaccord Genuity fintech and digital-assets analyst Joseph Vafi adds more color:

Last night, Binance disclosed a major breach of Binance 14, a hot wallet used by the company to consolidate and manage user deposits on the Ethereum network. While ~$5-6B in hacked funds is material, the Binance balance sheet, reportedly ~$150B, can cover any losses. What is more important is this hack’s impact on the broader digital assets ecosystem moving forward.

First, neither Bitcoin nor Ethereum was hacked; rather, a vulnerability was found in the core security stack that manages fund movement at Binance. The underlying value proposition of native coins is not the issue here. Binance has the balance sheet to cover such an incident, but smaller exchanges would not.

It should also be noted that both Tether and Circle were able to freeze approximately $2.3B in stablecoins that were part of the breach. We believe this was achievable in part due to the fact that stablecoins are not issued by a decentralized blockchain but by a centralized issuer. Thus, they can be tracked and frozen if need be. This stands in stark contrast to other blockchain-native assets, such as BTC and ETH, which are issued in a truly decentralized manner and thus can be much more difficult to trace and cannot be frozen. And while the stablecoins might be recoverable, they were also likely immediately used as collateral to borrow ETH across DeFi apps. And that ETH, if sold across blockchains such as TornadoCash, is not easily traceable. Thus, while the stablecoins were frozen and recoverable, the counterparties on the other side of the ETH borrowing transactions could lose out.

Ironically, the industry has touted decentralization as a key security aspect of public blockchains. And while that is true at the conceptual level, what is happening again and again is that a bespoke software stack is breached, and then full decentralization works against you in terms of asset traceability.

The digital assets industry has confronted and overcome much larger issues than this one, and we believe it will do so again. So what makes sense from here? Since inception, crypto has been about anonymous, decentralized ecosystems. We see the next evolution for digital assets as the tokenization of real-world assets, and a lot of this will not be transacted on permissionless networks. Privacy and security are table stakes for traditional finance, and thus the decentralized blockchain, while inherently secure, lacks centralized authority for things like asset freezing and traceability.

So where is the silver lining? Against this backdrop, somewhat centralized L1s such as Circle’s Arc and the Canton Network make a lot of sense to us. Transactions are still almost instantaneous, but control of the networks sits with a key group of industry-chosen validators. We think this is the best compromise structure and the way forward for mainstream blockchain at this point.

Finally, adding traceability to Bitcoin would deliver benefits that far outweigh the compromises, at least in our view. Maybe easier BTC traceability would be enough for the US Congress to pass Clarity. Maybe it would help bring crypto further into mainstream traditional finance. Maybe it would help bring Bitcoin into a post-quantum state. Time will tell, but it seems to us that so many of the benefits of blockchain are being repeatedly exploited in a fully permissionless and decentralized environment.

Crypto Rattled By Possible Binance Hack; Tether, Circle Freeze Billions In Stablecoins

Binance said Thursday it is investigating a “potential security issue” after billions of dollars in crypto left its exchange wallets, and the issuers of the two largest dollar stablecoins say they have frozen well over $1 billion of it. The exchange has not said how much was taken, how, or whether it was a hack.

“Our teams are aware of reports of a potential security issue and are actively investigating,” Binance said in a post on X. “User funds are completely safe.” FinanceFeeds, which reviewed the post’s edit history, reports that Binance changed it twice. The first version said the exchange had “not confirmed any impact to user funds”; at 21:24 UTC that sentence came out, and at 21:29 UTC “User funds are completely safe” went in.

Binance’s founder was less guarded. Changpeng Zhao, who says he no longer manages the exchange, wrote: “It does look like a hack on Binance.” As a shareholder, he said, he expects “all user funds will be fully covered.”

The freezes came from the stablecoin issuers. 

Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT “related to a potential Binance exchange hack.” Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC “in coordination with law enforcement.” Those are the issuers’ own figures. Zhao thanked Tether for about $971 million and Circle for about $823 million, and Decrypt counts 975.1 million USDT and 823 million USDC frozen in the main receiving wallet, about $1.8 billion. The posts do not say which addresses were frozen, so the totals do not reconcile.

Billions?!

Nobody has a confirmed loss figure. Decrypt’s on-chain tally is at least $5.57 billion across Ethereum, Bitcoin and Tron: $3.51 billion on Ethereum, $1.44 billion in 18,270 BTC and $630 million on Tron. The Block reports that Conor Grogan, a Coinbase senior director, put the total at up to $5.8 billion, while the security firm Blockaid is looking at about $3.3 billion in suspicious outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche. The tallies come from different trackers and may overlap, and Binance has confirmed none of them.

Glassnode also suggested over $5 billion worth of crypto assets moved.

Decrypt says the first Ethereum transfer, at 20:24 UTC, moved 167,464 ETH and 63 token transfers, including 1.615 billion USDT, to a new address. About three minutes earlier, an address funded through the Tornado Cash mixer had submitted an EIP-7702 delegation for a Binance hot wallet, a mechanism that lets a wallet hand its execution to outside contract code. Decrypt does not establish that as the cause, and how the attacker got the required signature is unknown.

Markets reacted. 

Bitcoin tumbled back below $80,000…

Decrypt has BNB down about 7% to roughly $699 and Bitcoin below $79,000, and The Block says on-chain data shows Aave froze lending markets to stop the suspected hacker from borrowing, though Aave has issued no statement.

If confirmed at anything near Decrypt’s figure, it would be more than triple the roughly $1.5 billion Bybit theft of February 2025, the previous record. Binance lost 7,000 BTC, about $40 million at the time, in a 2019 hack. It has promised updates “through official Binance channels.”