Crypto giant Binance races to recover $6.3bn stolen in hack linked to North Korea

In a historic digital asset theft, cryptocurrency exchange giant Binance is urgently attempting to recover a staggering $6.3 billion (approx. GHS 73.4 billion) stolen in a sophisticated cyberattack. The company revealed that around half of the missing digital assets, valued at approximately $3 billion (approx. GHS 35.0 billion), have been identified and frozen through coordinated efforts across multiple blockchain platforms and private-sector collaborators. However, a significant portion of the funds remains in the hands of unknown threat actors.

The breach unfolded swiftly, within a 20-minute timeframe, as funds were transferred across ten distinct blockchain networks beginning around 4 p.m. ET on Thursday. At first, the theft was believed to stem from a compromised laptop of a DevOps engineer. However, a more comprehensive internal investigation uncovered a wider infrastructure intrusion.

Binance's co-CEO, Richard Teng, explained the technical aspects of the breach during public updates, emphasizing that the attack was not perpetrated by a single individual. He detailed the attackers' evasion tactics, stating, "a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate."

To prevent further asset movement, Binance temporarily halted platform withdrawals while maintaining deposit infrastructure operational. The exchange announced a $5 billion (approx. GHS 58.3 billion) reserve to cover losses and committed an additional $1.34 billion (approx. GHS 15.6 billion) in cryptocurrencies to meet the total stolen amount. Executives swiftly reassured users that their money remained safe and that Binance would cover all losses.

Intelligence analysis suggests that the attack was carried out by North Korean state-sponsored cyber units. Blockchain analytics firms TRM Labs and Chainalysis have identified technical similarities between this theft and previous incidents linked to Pyongyang's network operations, attributing the attack to the Lazarus Group, a specialized collective operating on behalf of the North Korean regime.

Despite North Korea's denials, on-chain transaction flows and defector testimonies contradict these claims, asserting that the country is actively involved in state-sponsored cyber operations to generate revenue for the regime.

U.S. federal authorities are investigating the security breach due to the involvement of dollar-pegged assets like Tether and Circle. The U.S. Secret Service, in collaboration with the U.S. Attorney's Office for the District of Columbia and other law enforcement agencies, is actively working to identify, freeze, trace, and recover the stolen funds. Private stablecoin operators Circle and Tether also assisted authorities by freezing tagged addresses holding the stolen funds across various networks.