North Korean Hackers Blamed for $6.3bn Binance Theft

Blockchain intelligence firm TRM has attributed a record-breaking $6.3 billion theft from the cryptocurrency exchange Binance to North Korea's TraderTraitor hacking unit.

The theft is believed to be the largest cryptocurrency heist on record, surpassing previous attacks on digital asset platforms.

TraderTraitor is a hacking group that has previously been linked to North Korean state-sponsored cyber operations targeting crypto firms.

According to the media outlet Decrypt, the hacker responsible for the Binance breach is now converting the stolen assets from stablecoins into ethereum.

Stablecoins are cryptocurrencies pegged to stable assets, typically the US dollar, and are designed to minimise price volatility.

Crucially, stablecoins can be frozen by their issuing companies if they are linked to illicit activity, effectively blocking access to the funds.

Ethereum, by contrast, operates on a decentralised network and cannot be frozen in the same way, making stolen funds far harder to recover.

This conversion strategy appears designed to evade efforts by authorities and crypto firms to trace and block the proceeds of the hack.

North Korea has repeatedly been accused by cybersecurity researchers and governments of orchestrating large-scale cyberattacks on cryptocurrency exchanges to fund its state activities.

Such attacks have become an increasingly significant source of revenue for the country amid international sanctions restricting its access to traditional financial markets.

TRM, the firm behind the attribution, specialises in blockchain analytics and works with governments and financial institutions to track illicit crypto flows.

The scale of the Binance hack underscores persistent vulnerabilities within the cryptocurrency industry, even among its largest and most established platforms.

It is likely to intensify scrutiny of security practices at major exchanges and renew calls for tighter regulation of digital asset markets.

Binance has not yet issued a detailed public response to TRM's findings regarding the attack's origin or the current whereabouts of the stolen funds.