The world's largest cryptocurrency exchange, Binance, has fallen victim to a massive cyberattack that surpassed all previous digital asset incidents in terms of stolen funds. According to a report by analytical firm TRM Labs, published by Reuters and syndicated by CNN, the attackers managed to siphon digital assets across 10 different blockchain networks totaling approximately $6.36 billion. According to researchers, the bulk of the funds was transferred within just 20 minutes, indicating a high degree of preparation and pre-built infrastructure for asset withdrawal. RBC-Ukraine presents this data as a basis for assessing the scale of the incident.
Attribution of the Attack to a North Korean Group
TRM Labs analysts with high confidence link the incident to the elite hacking group TraderTraitor, operating, in their estimation, under the control of the North Korean government. The report emphasizes that the conclusion is based on a complex of on-chain and off-chain data: “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust intelligence both on-chain and off-chain. We make this determination with high confidence.” At the same time, it is important to note that this is an expert attribution based on digital footprints, rather than a formal indictment or confirmation by North Korean state bodies.
Attack Vector and Infrastructure Compromise
The primary vector of the attack was the compromise of the exchange's hot wallet signing infrastructure. According to an official Binance statement, preliminary investigation points to the potential compromise of a DevOps engineer's laptop. Gaining access to the internal infrastructure, the attackers were able to initiate unauthorized transactions. Meanwhile, the company states it has not yet found evidence of a leak of users' private crypto wallet keys, narrowing the scope of direct damage to the exchange's own operating systems.
What Was Frozen Versus What Remained with Hackers
Market participants reacted swiftly: Tether, Circle, and others managed to freeze approximately $2.7 billion in stablecoins and tokens controlled by the attackers. At the same time, analysts estimate that over $2.4 billion in BTC and ETH remains in the hackers' possession and is unreachable for blocking, as these assets lack a centralized freezing mechanism. A reminder of the timeline: on the evening of October 29, it was reported that nearly $3 billion had been withdrawn from hot wallets, and TRM Labs' final estimate for the entire incident totaled about $6.36 billion.
Binance's Response and Commitments to Users
Pending the investigation, Binance temporarily suspended deposits and withdrawals. The exchange announced cooperation with law enforcement and blockchain analysis specialists to track and recover the stolen assets. The company also publicly committed to covering all losses using its SAFU emergency insurance fund and corporate reserves, which should alleviate the urgency for asset holders on the platform.
Significance of the Incident for the Market
Due to the combination of factors—record-breaking amount, speed of withdrawal, and attribution of the attack to a state-backed group—this incident sets a precedent for the entire industry. It once again raises questions about the vulnerability of hot wallets and internal IT processes of major platforms, and reinforces the thesis that cyberattacks on crypto infrastructure are increasingly targeted and state-sponsored. Future dynamics will depend on the results of the joint investigation by Binance and law enforcement, as well as whether at least a portion of the frozen assets can be recovered.
