EXPLORINEER
en

DE — heise online

FBI: North Korea behind multibillion-dollar crypto theft from Binance

Security2 min read

The US FBI says North Korean hackers stole more than 6 billion dollars from the crypto exchange Binance. Binance says it will cover the losses so users do not pay.

What happened

The FBI says the North Korean hacker group TraderTraitor carried out the attack on Binance, the largest digital currency exchange. Before the FBI spoke, the research firm TRM Labs had already blamed the same group. The FBI asked companies to block deposits and withdrawals linked to certain addresses. This is meant to stop the group from hiding the stolen money. Binance paused all deposits and withdrawals for a while as a precaution. On Sunday morning, some withdrawals were possible again.

Key numbers

  • The FBI says the theft is worth more than 6 billion US dollars (about 5.37 billion euros).
  • TRM Labs says the attackers moved most of the 6.36 billion dollars within 20 minutes.
  • Binance says it has covered 90 percent of the stolen amount, for example through buybacks.
  • Part of the money was frozen. TRM Labs estimates 2.7 billion dollars in crypto, while Elliptic estimates 2.85 billion dollars.
  • The earlier record attack, on the exchange Bybit in early 2025, took about 1.5 billion dollars.

Background

Hackers often try to steal crypto from exchanges. Exchanges hold large amounts of digital money for their users. Some of the stolen money can be frozen by companies that help track crypto. The rest can be swapped into other coins, such as Ethereum, that are harder to freeze. Binance first said the attack started with a hacked laptop of a DevOps engineer, which is a worker who manages software systems. Later, Binance said there were several entry points and a complex attack that was not carried out by one person alone.

Why it matters

This is the largest known theft from a crypto exchange so far. It shows how strong state-linked hacking groups can be. For users, the key point is that Binance says it, not its customers, will bear the losses. The case also shows how government and companies work together to block stolen money.

What to watch

  • Whether the FBI or other governments name more people or groups.
  • How much of the stolen money can be frozen or recovered.
  • Whether Binance keeps all deposits and withdrawals running normally.
  • What new security steps Binance and other exchanges announce.

Glossary

Binance
A large website where people buy, sell and hold digital money such as Bitcoin.
TraderTraitor
The name of a hacker group that the FBI links to North Korea.
TRM Labs
A company that analyzes blockchain data to track crypto theft and money flows.
Elliptic
A crypto software company that helps track and check digital money transactions.
Bybit
Another large crypto exchange that was hacked in early 2025.
Ethereum
A digital currency and computer network used for apps and crypto transfers.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityZDNet Korea

AI Era Privacy Future: Calls to Unify "Collection and Provision" Under "Processing"

Panelists at the third "Everyone's Debate" forum, held by the Ministry of the Interior and Safety and the Personal Information Protection Commission, argued that Korea's consent-centered privacy system needs legal and safeguard reforms for the AI era. Proposals included merging the separate rules for collection and provision into a single "processing" framework, introducing joint processing, and recognizing "legitimate interest" more broadly while guaranteeing users a clear right to object and request deletion. Participants also noted that differing levels of identifiability and context call for differentiated regulation, and that data learned by AI models may remain even after deletion from databases.

Security전자신문

AI Security Race Shifts from 'Detection' to 'Automated Response'… Market Growth Also Accelerates

AI-driven cyberattacks are shifting the competitive focus of the global security market from threat detection and analysis to real-time blocking and automated response. Fortinet, Tenable, and F5, which recently reported earnings, said their security approaches have changed as AI attacks spread, and they expect security investment to grow as a result. F5 said its AI-based web application firewall blocked multiple attack variants in its own tests without new blocking rules after a recent PHP vulnerability disclosure.

Securityheise online

Popcorn Time: Abandoned Update Servers Threatened Mac Users

Security firm Eye Research reports that attackers could have taken over the abandoned update servers of Time4Popcorn, an alternative Popcorn Time client, and run arbitrary code, even with root rights on macOS, on affected Windows, macOS and Android systems. Eye Research instead took over the servers itself and pushed an update that stopped the insecure updater from running. The firm estimates that 250,000 to 350,000 macOS machines were affected, and the details were presented at the hack.lu conference.

SecurityZDNet Korea

Column on Security: The Fall of Human-Centered Cybersecurity

This ZDNet Korea column argues that this autumn's wave of breaches across Korea's financial sector, which the authorities say has hit 16 firms, exposed the limits of human-operated, patch-centered defense. It contrasts these attacks with historical examples such as the Opium War and calls for zero trust, AI-assisted defense, and leadership that measures security by how quickly intrusions are detected and stopped.