[REVISION HISTORY]

North Korean cryptocurrency exchange hacks

2 recorded revisions of this situation.

What changed

2026-10-30 10:41 UTC → 2026-10-30 12:39 UTC · added ~~removed~~

Investigations into a massive theft from the Bybit exchange in February 2025 revealed sophisticated laundering networks used by North Korean hacking groups. The FBI attributed the theft of approximately $1.46 billion to $1.5 billion to North Korean actors known as TraderTraitor. Analysts found that stolen funds were moved across multiple blockchains using decentralized protocols, with over $1 billion laundered within four months through professional networks and Chinese intermediaries. Following this, Binance reported a much larger security breach with an estimated impact of $6.3 billion. Preliminary findings suggest the attacker gained access via a compromised laptop belonging to a DevOps ~~engineer.~~ engineer, potentially allowing unauthorized access to a service container to submit withdrawal transactions. Intelligence firms, including TRM Labs and Chainalysis, linked this attack to the same TraderTraitor operation. The breach involved coordinated transfers across 10 different blockchains, including Bitcoin, Ethereum, Tron, and Solana, reportedly beginning with a $296 million XRP drain after 36 hours of preparation. In response to the Binance breach, approximately $3 billion in affected assets were frozen on-chain. This included Tether freezing approximately $1.57 billion in USDT and Circle freezing over $800 million in USDC. Binance stated it would cover all losses using company funds and its Secure Asset Fund for Users, noting that they found no evidence that private keys were compromised. The company temporarily suspended all deposits and withdrawals during the investigation.

Versions

Select a version to see what changed compared to the one before it.