It’s very likely that North Korea was behind the Binance hack.
Here’s a summary of what we know so far, along with some key figures:
Total impact: ~$6.3 billion stolen across 185 tokens.
Around $3 billion is frozen and will likely be recovered.
Another ~$2.5 billion is sitting untouched in BTC and ETH. It will likely remain dormant for months or even years, being laundered gradually.
Around $250 million in other tokens has already been sold.
Most of the immediate selling pressure has already passed. Even among smaller tokens, whatever hasn't been sold yet will probably have to be laundered gradually.
Binance has already stated that it will fully cover the losses without needing help from any partners. No users will be affected. As for the "lost" tokens, Binance plans to gradually buy them back from the market through OTC transactions and other methods.
Multiple analyses have already attributed the attack to TraderTraitor, a state-backed group linked to the Lazarus ecosystem, with high confidence. I've discussed this group in previous threads. Yes, you read that correctly, it's a STATE-BACKED group.
Everything suggests that the attack involved multiple layers and coordinated operations, but the main point of vulnerability was a compromised laptop belonging to a Binance DevOps engineer.
Two days before the theft, Binance announced that it had blocked North Korean attacks linked to the "Contagious Interview" campaign, which uses fake job opportunities to install malware. It's still unclear whether these "interviews" were the original source of the compromise, but it's certainly possible.
This points to human error as the primary attack vector, rather than an AI-driven attack.
BTC and ETH barely dropped because there really isn't much selling pressure. In a way, the laundering of BTC and ETH actually creates more buying pressure, since the supply is removed from the market, Binance first buys to replenish it, and the stolen assets are only gradually dumped over months or years.
The decline we've seen is mostly driven by the market itself, reacting to fear and uncertainty surrounding the incident. The same applies to many low-liquidity altcoins. Tokens directly affected by the hack experienced the initial dump, while others fell due to correlation, bots, FUD, etc.
That's everything I know at the moment. BTC and ETH options are also expiring on Deribit today, so volatility could be elevated. But unless something else happens, the situation should calm down soon.
Yes, this was the largest hack in crypto history in terms of dollar value, but it doesn't even come close to being the most consequential hack.
What matters isn't the raw dollar amount stolen, but the actual impact on the market. In 2014, for example, the Mt. Gox hack completely destroyed the exchange where almost all BTC trading took place. That was an incomparably worse situation.
Even if you combine every hack from 2025 and 2026, the total impact still comes nowhere close to what happened in 2014.
