Overview
- Security teams detected rapid multi‑chain transfers from wallets tied to Binance on Thursday night that analysts traced to an unauthorized withdrawal pattern totaling about $6.3 billion.
- Binance says roughly $3 billion of the affected assets have been frozen on public blockchains with help from partners while stablecoin issuers Tether and Circle blocked about $1.6 billion and $800 million respectively.
- Blockchain‑analysis firms including TRM Labs and Chainalysis have linked the operation to North Korea‑linked actors such as TraderTraitor/Lazarus, although U.S. law‑enforcement agencies have not publicly confirmed that attribution.
- Binance’s preliminary probe points to a compromised engineer laptop and access to a service container with additional breach points found later, and the company reports no evidence so far that private wallet keys were leaked.
- The exchange has suspended withdrawals, pledged to cover customer losses, said it is restoring services and tracing assets, and the episode is likely to increase regulatory scrutiny of custodial exchanges and crypto security practices.