Overview
- Binance disclosed on Friday that hackers stole about $6.3 billion, and the exchange suspended deposits and withdrawals while promising to reimburse all affected users.
- The company says it has located and frozen roughly half of the stolen assets, about $3 billion, with help from partners and blockchain tracking firms.
- TRM Labs has attributed the theft with high confidence to a North Korea-linked unit called TraderTraitor (connected to Lazarus), but that attribution has not been formally confirmed by authorities.
- Initial forensics point to a compromised laptop belonging to a Binance engineer as the attacker entry point, and Binance is working with the FBI and U.S. Secret Service while running system tests that it says could restore withdrawals in about 40 hours.
- The breach spotlights custody risks for exchange-held crypto, the limits of Binance's $1 billion SAFU reserve, and unresolved questions about where Binance obtained more than $6.3 billion to cover losses and how regulators in the EU and elsewhere will respond.