North Korea Has Turned Big Crypto Hacks Into Routine
The Binance theft of about $6.3 billion points to a familiar culprit, and about half the money has already been frozen.
WSJ What's News · The AI Trade Gets SpookyLarge crypto thefts have become a repeated pattern for hackers working for North Korea. The latest example is a theft of about $6.3 billion from Binance, the world's largest crypto exchange, attributed to a North Korean group called Trader Trader.
Several private firms that study hacks and track crypto flows have blamed North Korea, according to Alexander Osipovich, a Wall Street Journal reporter. Their view rests partly on a finding that part of the stolen Binance money was mixed together with proceeds from an earlier theft already attributed to North Korea. Osipovich did not present that attribution as certain.
About $3 billion has been frozen, leaving roughly half still with the hackers. Freezing was possible because some of the money was in stablecoins, which are cryptocurrencies designed to hold at about one dollar. Those coins are issued by Tether and Circle, the issuer of USDC, which can block specific addresses to stop the coins from moving further.
Crypto exchanges have long been robbed, but Osipovich said the past year or two has been different, with hacking teams working for North Korea growing more ambitious and sophisticated and carrying out a number of big hacks. There is separate concern in the industry about artificial intelligence giving hackers more powerful tools to break into exchanges, though it is not clear that such tools were used here. The day before the Binance theft came to light, the crypto based prediction market Polymarket was hit for less than $3 million, an incident that also drew attention to the risk of hacks in crypto.
Questions people ask
What is a stablecoin, and why can it be frozen?
A stablecoin is a cryptocurrency designed to stay worth about one dollar, backed by reserves like cash and short-term bonds. The largest ones, Tether and Circle's USDC, are issued by companies that can block specific addresses in the software. That lets them stop stolen coins from moving after a theft is reported.
How do researchers link a hack to North Korea?
They follow the money on public blockchains, where every transfer is visible, and look for patterns in tools, timing, and wallet addresses. If new stolen funds are mixed with older funds already tied to North Korea, that is a strong clue. Firms also compare the hacking methods with those seen in earlier attacks attributed to the same groups.
Will Binance users lose their money?
Binance suspended transactions after the hack, and its founder said user funds are safe, with its U.S. arm saying it was not affected. As general background beyond this case, large exchanges often say they hold reserves and have covered customer losses in the past. For example, Binance maintains an emergency insurance fund called the Secure Asset Fund for Users.