CNN Links $6 Billion Binance Crypto Theft to North Korea as Separate Breach Hits $6.3 Billion in Assets
A CNN report says North Korean hackers stole more than $6 billion in cryptocurrency from Binance, while a separate breach exposed $6.3 billion in assets on the exchange. The combination of alleged state-backed theft and a major security incident raises new questions about how resilient big crypto platforms really are.
North Korea-linked hackers are accused of siphoning off more than $6 billion in cryptocurrency from Binance, the world’s largest crypto exchange, according to a CNN report that points to an operation on a scale rarely seen even in state-backed cyber theft.
At the same time, Binance has faced a separate security incident in which attackers attempted unauthorized withdrawals affecting about $6.3 billion in assets, according to a technical account of that breach. Around $3 billion of those assets were reportedly frozen on-chain after the company and external partners spotted suspicious flows.
CNN, citing sources familiar with the matter, reports that North Korean hackers are responsible for stealing over $6 billion in cryptocurrency from Binance over time. The open-source material summarized so far doesn’t spell out the exact period, the methods used, or how much may overlap with previously known hacks. North Korea hasn’t commented, and Binance hasn’t publicly confirmed the specific attribution described in the CNN piece.
The more recent breach appears to have followed a different path. In that case, attackers allegedly gained access via a compromised laptop belonging to a DevOps engineer with broad permissions, then tried to push through a wave of unauthorized withdrawals. Binance’s internal safeguards and blockchain monitoring reportedly flagged anomalies in time to freeze a significant share of the targeted assets before they could be fully laundered.
For millions of retail users and institutional traders, the figures involved are stark even if the investigations are still unfolding. A single state-linked actor allegedly draining billions from one major exchange, and a separate attempt to exploit privileged internal access, both challenge assumptions that size and name recognition translate into safety in crypto markets.
Individual account holders can find their funds temporarily locked, subject to extra checks, or, in the worst case, never fully recovered if stolen assets move beyond reach. Staff with elevated system access become prime targets for hackers, turning routine work laptops into potential entry points for adversaries with geopolitical motives.
If CNN’s attribution stands up, it would reinforce assessments that cryptocurrency theft plays a central role in North Korea’s efforts to get around international sanctions. U.N. experts and Western governments already argue that funds from such hacks help finance weapons programs. A haul of more than $6 billion from one platform would mark a major expansion of that revenue stream.
For the wider financial system, these incidents add weight to concerns that even the biggest exchanges carry unique structural risks. The need to keep large sums accessible in online “hot” wallets, complex permission structures for engineers, and the pressure to process vast trade volumes all create attack surfaces that disciplined intruders can probe.
Regulators and law-enforcement agencies are likely to treat the CNN report and the latest breach as further justification for tougher rules and scrutiny. That could mean stricter limits on how much value exchanges hold in hot wallets, tighter oversight of internal access rights, and expanded efforts to track and seize funds linked to state-backed hacking units.
What happens next will hinge on how Binance publicly addresses both the North Korea allegations and the engineer-laptop breach, whether on-chain analysis clarifies the timing and scale of the thefts, and how regulators in major markets respond with new guidance or enforcement actions.
Sources
- OSINT