Binance Hackers Use Automated Money Laundering Described by Analysts as Unprecedented

Binance, the world's largest cryptocurrency exchange, resumed the release of Bitcoin, Ether, and certain stablecoins withdrawals this Sunday (1). This measure came after the platform covered about 95% of the US$ 6.3 billion (equivalent to approximately R$ 33.8 billion) in digital assets that were stolen.

The resumption of withdrawals will be done gradually, in distinct phases, with different groups of crypto assets being made available progressively. The first stage includes 15 crypto assets, among them Bitcoin, Ether, XRP, and Dogecoin. Bitcoin withdrawals were normalized shortly after 6 am (Brasília time), and operations with Ether, BNB, and stablecoins such as USDT and USDC were also released.

The company itself stated that it managed to cover about US$ 6 billion (R$ 32.2 billion) of the stolen funds using its own resources, designated for the acquisition of substitute assets. The remaining 5% refers to coins with lower liquidity, whose redemption may take longer to complete.

The attack, which the FBI attributed to a hacking group linked to North Korea, is seen by analysts as one of the largest financial thefts ever documented. Most of the value was transferred in an approximate period of 20 minutes, during the night of Thursday (29).

On Saturday (31), the FBI confirmed that the action was executed by TraderTraitor, a group supported by the North Korean state. This unit is linked to espionage activities, financial robberies, and revenue generation for the government of Pyongyang.

According to the US agency, investigators identified members of the group converting the stolen assets into Ether. The FBI also predicts that the criminals will attempt to launder these funds using technologies related to cryptocurrency transactions.

North Korea has denied for years the use of state cyber units for financial robbery and espionage purposes. The country's diplomatic mission in Geneva (Switzerland) and its embassy in China did not respond to comment requests made by Reuters.

American blockchain analysis companies, such as TRM Labs and Chainalysis, also pointed to North Korea as responsible for the attack. Researchers from these companies indicated that the speed of the operation and the characteristics of the theft bear similarities to other major attacks attributed to the country.

Despite the conclusions presented by the FBI, U.S. President Donald Trump declared on Saturday (31) that the American government still had no certainty about North Korean involvement. Trump commented to journalists via a White House account on X: 'We don't know if it was North Korea—but if it was, we will talk to North Korea about it.'

Binance assured that it would fully cover the financial loss resulting from the assault. To this end, the exchange reserved about US$ 6.34 billion (approximately R$ 34 billion) of its own resources to cover the losses. Furthermore, the platform collaborated with cryptocurrency industry partners to block part of the affected assets, having located about US$ 3 billion (R$ 16.1 billion) by Friday (30).

The funds used to purchase substitute tokens came from various sources: the Secure Asset Fund for Users (SAFU), Binance's customer protection fund; the company's futures operations insurance fund; and the company's corporate treasury.

SAFU maintains a reserve of US$ 1 billion (about R$ 5.4 billion) in Bitcoin and was established to support users in security failure scenarios. Yi He, one of Binance's co-CEOs, announced on Saturday that half of the SAFU resources would be allocated to dealing with the consequences of the attack, and the company committed to replenishing the fund until it reached US$ 1 billion again.

Richard Teng, another co-CEO of the exchange, characterized the incident as a sophisticated attack. He explained that the intruders used a compromised laptop and malware designed to erase traces of their actions, which complicated tracking and investigation.

In a post on X replicating the FBI's statement regarding possible North Korean involvement, Binance expressed its gratitude to the US agency for the support. However, the exchange did not provide a direct response to a Reuters inquiry about North Korea's involvement.

Changpeng Zhao, the founder of the company, also emphasized the cooperation of the American authorities. He highlighted the crucial role of security agencies in tracking and freezing the stolen assets, stating that the authorities' actions helped mitigate the impact of the attack on the cryptocurrency market.

Zhao mentioned in his post that no social media message would be enough to express the company's gratitude. It is worth remembering that the businessman had already been convicted in the United States for failing to maintain an effective anti-money laundering system at Binance, subsequently receiving a presidential pardon from Donald Trump the previous year.

Industry experts assert that the Binance hack, amounting to a record $6.3 billion and becoming the largest cryptocurrency theft globally, demonstrated operational weaknesses in crypto exchanges rather than any issues with the blockchain technology itself.

The world's largest cryptocurrency exchange estimated the total alleged damage at approximately $6.3 billion, which is four times the amount stolen during the previous record—the Bybit hack. About $3 billion in assets that passed through wallets linked to hackers were identified and frozen. The exchange promised to cover all incurred losses.

Binance reported that initial investigations pointed to a compromised DevOps engineer's laptop, which allowed the attacker access to a service container and sent unauthorized withdrawal transactions. Later, the exchange clarified that further study uncovered additional points of entry, contradicting the initial finding of a single compromised laptop. However, the exchange stated it found no evidence of private wallet key leakage.

The UAE financial services regulator overseeing the Abu Dhabi Global Market stated that it is aware of the incident and is monitoring the situation. Binance confirmed that it has allocated over $6.34 billion from its own funds to cover the consequences of this incident.

Georgy Kucherin, Senior Security Researcher at Kaspersky GReAT, noted that the attack on Binance and a separate incident on the Polymarket prediction platform involving a compromised script from third-party developer DebugBear prove that exchanges can be hacked both through internal systems and external dependencies. He added that technical personnel remain the weak link, as even experienced engineers can inadvertently upload malware.

Sandip Pyapali, founder and CEO of Mesta, suggested that the attacker likely used the exchange's own access channels. He believes that if the hacker gained privileges through an employee's device, the system might have accepted the withdrawals as legitimate. Pyapali characterized the event as a 'maturity test' for the crypto industry, not a catastrophe, noting that exchanges will now require more robust safeguards, deeper insurance, and larger reserves.

Karsten Menke, Head of Next Generation Research at Julius Baer, stated that this incident is a 'company problem, not a crypto problem,' thereby highlighting the risks of holding assets on centralized exchanges. He recommended using self-custody in offline cold storage to reduce risk exposure. Menke also mentioned that there is no evidence of AI involvement in the attack, but noted that AI reduces the cost and speed of sophisticated attacks. He cited industry estimates that one of four malicious attacks now utilizes AI, reiterating Julius Baer's constructive view on cybersecurity.

Vincent Choc, CEO and Founder of First Digital, noted that the past day showed how crucial coordination between exchanges, issuers, and networks is when they exchange information within hours. Sergey Kunts, co-founder of 1inch, reported that Tether and Circle froze over $2.4 billion in stablecoins, and other teams blocked addresses associated with the exploit. According to him, this 'significantly limited' the attackers' ability to move funds.

Hackers stole $6.3 billion (equivalent to approximately 33.71 billion Brazilian reais) from Binance, the world's largest cryptocurrency exchange. Analysts consider this incident the largest in the sector's history.

This incident caused a market drop, prompted industry companies to freeze some funds, and raised questions about the security of digital asset trading platforms.

According to the American blockchain analytics company TRM Labs, the attackers gained access to Binance wallets across 10 different networks and transferred the majority of the funds in about 20 minutes. The company linked this attack to North Korean groups, noting technical similarities with previous thefts attributed to Pyongyang, including the 2025 hack of the Bybit exchange, which was investigated by the FBI.

Chainalysis reported that it could not yet confirm the cause of the intrusion. By 9:30 AM Brazilian time, the company had identified at least $5.912 billion (approximately 31.63 billion Brazilian reais) in stolen assets.

Mark Karpeles, former head of the Mt. Gox exchange, told Reuters that Binance's assets appear to be distributed across different systems. He speculated that the hacker might have obtained valid authorization to move funds in certain platform systems and possibly even access to a private key.

Binance cooperated with partners to block the affected resources and managed to localize about $3 billion (16.05 billion Brazilian reais). Co-founder Yi He confirmed that the company would cover all losses resulting from the attack.

Other companies also participated in efforts to prevent the movement of funds. Binance's initial investigation showed that the breach might have started with the compromise of one engineer's computer. This access allowed the attacker to penetrate one of the exchange's systems and execute unauthorized withdrawals.

The company stated that user deposits were unaffected and expected to resume withdrawals within 48 hours after the attack. Binance also holds a customer protection fund composed entirely of Bitcoin.

For Kenneth Goh, Director of Private Capital Management at UOB Kay Hian, the attack on one of the world's largest exchanges should prompt investors to pay more attention to asset custody and platform responsibility in case of security failures.

The market reacted to the incident with decreased trading. Bitcoin fell by more than 3%, reaching a six-week low of $76,368. Ethereum also lost over 3%, dropping to $2,178. Coinbase shares fell by 4.8%, and Strategy shares dropped nearly 6% in extended trading in the United States.

Amanda He, Investment Director at ChainUp Investment, told Reuters that the initial drop might have been caused by the cryptocurrency being sold by the attacker himself. In her opinion, this step contributed to spreading investor concerns during the Asian session. She mentioned that her company sold positions held on Binance and converted the proceeds into stablecoins.

For Tim Sun, Senior Researcher at HashKey Group, the pause in deposits and withdrawals on Binance could negatively affect capital flow between platforms and impact market makers responsible for providing buy and sell prices to facilitate trades.

Liquidity concerns are also featured in assessments by Damon Xu, founder of 1Token. Commenting to Reuters, he predicted a reduction in strategies involving simultaneous operations across different exchanges and the use of leverage, which allows trading with borrowed funds. Xu believes that decentralized platforms may benefit from potential capital and commercial activity shifts.

Jeff Ko, Lead Analyst at ViaBTC, assessed to Reuters that Bitcoin might face less selling pressure because its transactions are tracked on the blockchain, making it difficult to move stolen funds without leaving traces. Ethereum, conversely, might experience greater pressure due to the availability of tools that facilitate obscuring transaction origins.