Overview
- Binance disclosed late Thursday that attackers moved about $6.3 billion of crypto from its wallets across ten blockchains in a burst of transfers that took roughly 20 minutes.
- Blockchain forensics firm TRM Labs and multiple news analyses attribute the operation with high confidence to the North Korea‑linked group TraderTraitor.
- Industry partners including Tether and Circle located and froze roughly $3 billion of the affected assets, with Tether accounting for about $1.57 billion and Circle for more than $800 million.
- Binance and investigators say the likely entry point was a compromised DevOps or engineer laptop that let attackers use internal signing infrastructure to trigger unauthorized withdrawals, highlighting the custody risk when exchanges control transaction keys.
- Withdrawals remain suspended while Binance promises to cover customer losses from its safety fund and company resources and works with blockchain forensics firms and law enforcement, including the FBI, to trace and recover remaining assets.