// TECHCRUNCH — FINANZA
North Korean hackers blamed for stealing record $6.3B in Binance breach
Hackers working for the North Korean regime have been blamed for a record cryptocurrency heist following a cyberattack at crypto exchange Binance. The hackers stole at least $6.3 billion in crypto from the company’s wallets, though about half of that amount was frozen as the stolen crypto traveled across various blockchains, according to security researchers.
The breach is by far the largest known theft of crypto in history, though the incident has not been confirmed yet to be resolved, and the amount of crypto stolen may change.
In a post on X, Binance said its initial investigation showed that the hackers broke into the company’s network after targeting a “compromised” Binance engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Binance said it has seen no evidence of a leak of its private keys, which would grant the hacker near-unfettered control over the company’s stores of crypto.
The crypto exchange — the world’s largest — said it has now suspended all deposits and withdrawals while its investigation into the breach continues. TechCrunch reported on Thursday that the exchange had paused withdrawals across some of its blockchains.
Binance said “user funds are safe,” but did not immediately provide proof of this claim. The company said it will “publish an updated proof of reserves once the remediation is complete.”
Spokesperson Andie Cooper said in a statement shared with TechCrunch on Friday that some $3 billion has been frozen by industry partners. The spokesperson said Binance has “begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.”
It’s unclear how the hack went down or under what circumstances the employee’s laptop was compromised, but it’s not uncommon for security incidents to stem from the use of compromised software on employee devices.
Software is generally built from many components, including open-source projects, which hackers regularly target, compromise and modify in order to steal data from devices that the affected software is installed on. Other times, malware bundled with regular-looking apps and games can allow hackers to steal usernames, passwords and session tokens from infected computers, which may let them log in as if they were a legitimate employee.
Binance will face questions about why the company’s security allowed a single employee’s laptop to access systems capable of controlling billions of dollars in funds.