Tokyo. Hackers linked to North Korea have stolen cryptocurrencies worth approximately $6.3 billion from Binance, the world’s largest crypto exchange. The attack began on October 29 at around 4:20 p.m. U.S. Eastern Time and involved funds held in Hot wallets connected to the internet.

The attackers spread the assets across ten blockchains and numerous smaller transactions. According to Chainalysis, they exchanged $325 million in stablecoins for $285 million worth of Ether in less than 20 minutes, accepting a discount of more than 10 percent. The rapid conversion was intended to prevent the stablecoins from being frozen by their issuers.

An emergency response involving Binance, stablecoin issuers including Tether and Circle, authorities and blockchain analysis firms managed to freeze between $2.8 billion and $3 billion, according to Chainalysis and Binance. Chainalysis described the coordinated response as evidence that the crypto industry is becoming faster at acting against large-scale thefts.

A significant portion of the stolen assets consists of Bitcoin and Ether, which cannot be frozen in the same way. TRM Labs said the attackers still controlled more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion.

The precise method used to access Binance remains unclear. The exchange said the attack probably began with the compromise of an IT engineer’s laptop. The attackers allegedly used the device to enter an internal service system and authorize fraudulent withdrawals. There is currently no indication that private wallet keys were stolen.

Binance co-chief executive Richard Teng said the attackers also deployed malware designed to erase its own traces. Social engineering or phishing may have been used to gain access to the laptop and other systems, but the route remains under investigation.

Binance has pledged to cover all customer losses. By Sunday, the exchange said it had replaced around 95 percent of the stolen assets, using its Secure Asset Fund for Users, established in 2018, along with corporate reserves worth several billion dollars. The eventual net loss could be reduced if the frozen funds are recovered, although it remains unclear whether and when they will be returned to Binance.

The exchange gradually resumed withdrawals on Sunday, beginning with Bitcoin. The FBI, the U.S. Secret Service and the IRS Criminal Investigation division also warned traders about efforts by the group known as TraderTraitor to move the stolen assets. The agencies published a list of suspicious addresses.

Authorities said the attackers were continuing to convert the stolen assets mainly into Ether. They are expected to launder the funds through decentralized finance platforms and instant-exchange services.

The group has been active for years. Mandiant, the Google-owned cybersecurity company, identified it in 2023 as UNC4899, a North Korean actor that had previously targeted crypto companies. Mandiant assessed with high confidence that UNC4899 was a cryptocurrency-focused unit of North Korea’s Reconnaissance General Bureau and likely corresponded to TraderTraitor.

TraderTraitor is part of a broader network used by North Korea to obtain foreign currency through cyberattacks, covert IT operations and front companies. The network also includes Lazarus, APT38—also known as Blue Noroff—Andariel and Kimsuky, which are associated with financial theft, ransomware and espionage.

Thousands of North Korean IT workers have also obtained software jobs abroad under false identities, often operating from countries including China and Russia. Their earnings are transferred largely to North Korea. Chainalysis said North Korean groups increasingly place such workers inside crypto companies to obtain privileged access that can later support attacks.

The country’s hackers are selected and trained from an early age, with students showing strong mathematical ability receiving instruction in programming. Competitive training and study at leading universities focus not only on computing but also on solving complex problems with limited resources.

That preparation has helped North Korean groups become effective at social engineering and phishing. artificial intelligence is now also being used to produce convincing messages and job applications aimed at potential targets. After first focusing on banks, the groups shifted toward cryptocurrencies as the sector expanded, and the Binance theft demonstrates the continuing scale of that threat.

Sources: Handelsblatt.