Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 732 sources · 21 days · First seen 22 days ago · Last updated 1 day ago

North Korean cryptocurrency exchange hacks

Overview

Investigations into a massive theft from the Bybit exchange in February 2025 revealed sophisticated laundering networks used by North Korean hacking groups. The FBI attributed the theft of approximately $1.46 billion to $1.5 billion to North Korean actors known as TraderTraitor. Analysts found that stolen funds were moved across multiple blockchains using decentralized protocols, with over $1 billion laundered within four months through professional networks and Chinese intermediaries.

Following this, Binance reported a much larger security breach with an estimated impact of $6.3 billion. Preliminary findings suggest the attacker gained access via a compromised laptop belonging to a DevOps engineer, potentially allowing unauthorized access to a service container to submit withdrawal transactions. Intelligence firms, including TRM Labs and Chainalysis, linked this attack to the same TraderTraitor operation. The breach involved coordinated transfers across 10 different blockchains, including Bitcoin, Ethereum, Tron, and Solana, reportedly beginning with a $296 million XRP drain after 36 hours of preparation.

In response to the Binance breach, approximately $3 billion in affected assets were frozen on-chain. This included Tether freezing approximately $1.57 billion in USDT and Circle freezing over $800 million in USDC. Binance stated it would cover all losses using company funds and its Secure Asset Fund for Users, noting that they found no evidence that private keys were compromised. The company temporarily suspended all deposits and withdrawals during the investigation.

Entities

Tether · North Korea · FBI · zeroShadow · Etherscan

Claims

What the coverage asserts, and how many sources carry each claim.

[● 48 SOURCES] Changpeng Zhao stated that user funds are safe. kryptomagazin.cz · blockchainreporter.net · coindoo.com · news.bitcoin.com · cryptobriefing.com · +44 more
[● 22 SOURCES] Changpeng Zhao stated that the event looks like a hack on Binance. kryptomagazin.cz · blockchainreporter.net · coindoo.com · news.bitcoin.com · www.cnbce.com · +18 more
[● 59 SOURCES] Binance is actively investigating a potential security issue. blockchainreporter.net · coindoo.com · news.bitcoin.com · kryptomagazin.cz · cryptocompass.com · +55 more
[● 36 SOURCES] Tether froze more than $1.567 billion in USDT related to the potential hack. btcwires.com · news.bitcoin.com · cryptobriefing.com · kryptomagazin.cz · bitnewsbot.com · +31 more
[● 36 SOURCES] Circle froze approximately $823 million in USDC. kryptomagazin.cz · blockchainreporter.net · coindoo.com · cryptobriefing.com · bitnewsbot.com · +31 more
[● 30 SOURCES] Between $2.5 billion and $5.8 billion in cryptocurrency left Binance hot wallets. kryptomagazin.cz · blockchainreporter.net · btcwires.com · news.bitcoin.com · cryptobriefing.com · +25 more
[● 28 SOURCES] Binance has temporarily suspended all deposits and withdrawals. www.mojkraj.hr · www.naewna.com · brandinside.asia · ascii.jp · www.centraldenoticiasmadariaga.com · +24 more
[● 22 SOURCES] Hackers may have accessed the system via a compromised DevOps engineer's computer. www.naewna.com · brandinside.asia · www.vecernji.hr · advocatengr.com · alsaudi.news · +17 more
[● 20 SOURCES] The cyberattack impact is estimated at approximately 6.3 billion dollars. www.naewna.com · brandinside.asia · advocatengr.com · alsaudi.news · www.batmanrehbergazetesi.com · +15 more
[● 18 SOURCES] Approximately 3 billion dollars in stolen assets have been frozen. www.naewna.com · brandinside.asia · www.vecernji.hr · advocatengr.com · alsaudi.news · +13 more
[● 17 SOURCES] The transaction initiating the outflow was funded through Tornado Cash. kryptomagazin.cz · blockchainreporter.net · www.spacemoney.com.br · www.crypto-news-flash.com · cryptobriefing.com · +12 more
[● 17 SOURCES] The outflow included approximately 167,464 ETH from the Binance 14 wallet. kryptomagazin.cz · blockchainreporter.net · www.spacemoney.com.br · www.sondakika.com · bitnewsbot.com · +12 more

Timeline

1 day ago

[TECHNOLOGY] 732 sources FAST-MOVING
Binance reports $6.3 billion security breach
Binance is investigating a record $6.3 billion crypto hack, potentially linked to North Korean hackers. The exchange has suspended services and pledged to cover all user losses.
22 days ago

[TECHNOLOGY] 4 sources
Bybit theft exposes North Korean cryptocurrency laundering networks
North Korean hackers, identified by the FBI as TraderTraitor, stole approximately $1.5 billion from Bybit in February 2025, utilizing complex cross-chain laundering networks to move funds.

Sources

0223.com.ar · 20minutos.es · 24sata.hr · 3news.com · 4gnews.pt · 5min.at · 6abc.com · abcbourse.com · abcnews.al · abranet.org.br · ac24horas.com · actualidad.rt.com · ad-hoc-news.de · adressa.no · adslzone.net · advocatengr.com · aeiou.pt · aerotendencias.com · afamily.vn · agderposten.no · agenpress.it · agora-web.jp · agorarn.com.br · ajkerpatrika.com · aktual.com · aktuelno.me · albeu.com · albiladpress.com · alertas24.com · alfalfalfa.com · alhayatp.net · aljazeera.com · alkuwaitnews.net · almakos.com · alsaudi.news · altavoz.pe · altonivel.com.mx · alwakeelnews.com · ambcrypto.com · android-mt.ouest-france.fr · anlatilaninotesi.com.tr · appinn.com · apuntmedia.es · arabic.euronews.com · archive.in.gr · arecoa.com · arenait.net · ariadna.elmundo.es

This summary has been updated 2 times: see revision history