North Korean Hackers Blamed for Binance Breach in Tactics Echoing Bybit Attack

A North Korean hacking group has been identified as being behind the large-scale hack of Binance, the world’s biggest digital-asset exchange.

CNN reported on October 30 that blockchain analytics firm TRM Labs, after analyzing on-chain and off-chain data, concluded a North Korean hacking group was involved in the Binance breach.

TRM Labs said it detected small fund movements through Tornado Cash before the attack. It added that the hackers used pre-obtained signatures to steal assets in a short period, a pattern similar to past North Korea-linked hacks.

The firm said the same method was also seen in the Bybit hack in February last year and the KelpDAO hack in April this year. Based on a combined analysis of on-chain and off-chain information, it added that it has high confidence the attack was carried out by the North Korean hacking group TraderTraitor.

Other analytics firms reached similar conclusions. Singapore-based Pangolin Intelligence said its comparison of on-chain transactions tied to the breach with past incidents involving North Korean hacking groups showed a high likelihood that North Korea was responsible.

Chainalysis also said North Korea was likely behind the attack. The firm is tracking the stolen funds as they move across multiple blockchains, including Bitcoin and Ethereum.

The hack is believed to have begun after a Binance engineer’s laptop was compromised. The hacker then accessed internal services and executed unauthorized withdrawal transactions.

Losses from the hack are currently estimated at about $6.36 billion.