North Korean unit likely behind $6.3 billion hack on Binance, blockchain intelligence firm says

A North Korean entity is likely behind the cyber hack Thursday in which roughly $6.3 billion was stolen from cryptocurrency giant Binance, according to U.S.-based blockchain intelligence firm TRM Labs.

Binance reported late Thursday it suffered a “security incident” involving as much as $6.3 billion in cryptocurrency, and it has frozen affected assets and plans to cover any losses after a full investigation.

TRM Labs attributed the attack "with high confidence" to TraderTraitor, which it described as an elite, state-sponsored hacking unit operating out of North Korea, the company said in a statement. 

The firm said that the group moved roughly $6.36 billion out of Binance wallets on ten blockchains, most of which happened in about 20 minutes. 

The world’s largest cryptocurrency exchange said the episode “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.

“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” the company said. “The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.