Overview
- Binance disclosed late Thursday that attackers moved roughly $6.3 billion from its operational hot wallets over about 20 minutes and the exchange temporarily suspended withdrawals while it runs security checks.
- Blockchain intelligence firms Chainalysis and TRM Labs say they have high confidence the operation matches TraderTraitor, a North Korea–linked unit, based on on- and off-chain links to prior hacks.
- Stablecoin issuers and partners, including Tether and Circle, froze targeted balances that together account for roughly $2.3 billion of the located funds and Binance says about $3 billion has now been frozen on-chain.
- Binance says its preliminary probe points to a compromised DevOps engineer laptop and access to signing/authorization infrastructure, that user account logins were not affected, and the company will cover losses using SAFU and company funds.
- The breach rattled crypto markets, raised fresh questions about custodial risk at centralized exchanges, and is likely to draw renewed regulatory and law‑enforcement scrutiny as tracing and recovery efforts continue.