Binance hack blamed on North Korea

On Oct 31, TRM Labs and Chainalysis identified North Korea's Lazarus Group, also known as TraderTraitor, as the likely culprit in the $6.3bn Binance hack. They said the group used a special authorisation to turn a hot wallet into one that moved funds automatically. On Nov 2, FBI and Secret Service said TraderTraitor stole more than $6.3bn from Binance and listed 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address for blocking.

Binance reopened on Sunday and customers withdrew more than $3.6bn. The company said it had covered about 95% of stolen assets, later saying 98% of affected assets had been replenished. On Nov 3, North Korea denied U.S. allegations, with Kim Yo Jong calling the claim a grave political provocation. Analysts said hackers used thousands of wallets across multiple blockchains to obscure the funds.

Binance said the hackers used fake job interviews, malware and a compromised internal AI tool, with preparation beginning in June and continuing in September. North Korea fired strategic cruise missiles on Nov 3 and several missiles into the Sea of Japan on Nov 4, its fourth weapons launch in a month. Kim Yo Jong said dialogue with Washington is unnecessary until the U.S. abandons its hostile policy.