What Happened
Binance said on Thursday a security incident affected about $6.3 billion in assets, according to The Hacker News. The exchange says a compromised DevOps engineer laptop gave an attacker access to a service container and let the attacker submit unauthorized withdrawals. Binance reports no evidence of a private key leak. It suspended deposits and withdrawals and says it will cover losses from its SAFU fund and its own funds.
TRM Labs describes one transaction holding 50 pre-signed authorizations, followed about three minutes later by a sweep of the hot wallet, including 1.615 billion USDT. TRM Labs and Chainalysis attribute the theft to North Korea with high confidence and link it to TraderTraitor, the group behind the Bybit heist. Elliptic also points to North Korea-linked actors but urges caution. Chainalysis estimates about $5.912 billion was stolen, the largest crypto heist on record. Issuers and partners froze about $2.67 billion in stablecoins.
Why This Matters for Canadian Organizations
Canadian crypto trading platforms, fintechs, and payment firms rely on hot wallets and automated signing through service accounts. The attack began on one engineer’s laptop and moved through a service container to the signing process. Any Canadian firm with privileged engineers and automated production access shares this path.
Crypto platforms operating in Canada carry FINTRAC reporting duties as money services businesses. Expect blockchain analytics alerts tied to this theft and screen incoming deposits against published attacker addresses. State-backed theft funds sanctions evasion, so compliance teams should treat exposure to these wallets as a priority review item. Our Trends coverage follows nation-state financial attacks.
What to Do
Harden DevOps laptops with endpoint detection and remove standing production access. Isolate signing services from general engineering networks. Require out-of-band approval for large withdrawals and cap the number of pre-signed authorizations. Alert on batched transactions and sudden hot wallet sweeps. See our latest news for further developments.
