North Korean hacking group makes off with $6.3B in 20 minutes; 95% of stolen funds recovered or covered
Net outflow hits $3.6B following resumption of withdrawals; domestic exchanges discuss raising cold wallet storage ratios
A massive cryptocurrency heist exceeding 8 trillion won ($6 billion) at Binance, the world's largest digital asset exchange, has triggered heightened security reviews across South Korean crypto platforms. Although Binance managed to cover the vast majority of the compromised assets, the resumption of withdrawals triggered a multi-billion-dollar flight of capital, prompting South Korea’s Financial Services Commission (FSC) to summon domestic exchanges for an emergency review of customer asset protection measures on Tuesday.
$6.3 Billion Siphoned in 20 Minutes; Billions Flee as Withdrawals Resume
On November 29, approximately $6.3 billion (roughly 8.4 trillion won) in cryptocurrency was stolen from Binance in what is believed to be the largest exchange hack in history. According to foreign media and cybersecurity industry sources, the attackers gained access to internal systems by compromising an employee's work laptop. A massive outflow of assets was executed across 10 blockchains in the span of roughly 20 minutes.
On October 31, the U.S. Federal Bureau of Investigation (FBI) pointed the finger at "TraderTraitor," a North Korea-linked hacking collective also implicated in last year's roughly $1.5 billion Bybit hack. Stating that the stolen funds were primarily being converted into Ethereum, the FBI published related wallet addresses and requested that transactions be blocked.
Binance halted withdrawals immediately following the incident and moved to secure customer assets. On December 1, the exchange announced it had recovered roughly 95% of the losses or covered them using internal capital and its user protection fund, subsequently resuming major crypto withdrawals in phases.
However, the move unleashed a wave of customer withdrawals. According to the Financial Times, $4.65 billion was withdrawn while $1.01 billion flowed in over a roughly 9.5-hour window after withdrawals reopened. Net outflows stood at $3.64 billion, representing about 2.1% of the exchange's assets held prior to the incident. Binance noted that capital flows have been stabilizing following the initial surge in withdrawals.
Patching stolen assets and retaining departing clients, however, are two entirely different challenges. Binance’s Japanese operating entity also temporarily suspended crypto withdrawals as a precautionary measure before gradually resuming them.
FSC Summons Domestic Exchanges; Will Cold Wallet Ratios Rise?
According to KBS on Tuesday, the FSC convened an emergency security inspection meeting at 10 a.m. involving representatives from won and non-won exchanges, including Upbit, Bithumb, and Coinone. The meeting served to share details of the Binance hack while reviewing domestic exchange security frameworks and customer asset protection protocols.
Discussions are reportedly centered on raising the proportion of assets stored in "cold wallets," which are isolated from the internet. While cold wallets offer superior safety against online attacks compared to internet-connected hot wallets, they impose limitations on rapid deposits and withdrawals.
Current South Korean legislation under the Virtual Asset User Protection Act mandates that exchanges keep at least 80% of customer digital assets in cold storage. By exchange, these ratios currently stand at over 99% for Upbit, the 94% range for Bithumb, 85% for Coinone, and the low-80% range for Digital X and Streami, the operator of Gopax. While all platforms meet the statutory minimum, variances remain in the proportion of assets left exposed to online environments.
South Korea has also recently weathered a string of security incidents, including employee information leakage at Bithumb and a roughly 100 million won crypto heist at PraSox. The FSC is scheduled to hold another security review meeting on December 5, attended by the Financial Supervisory Service, the Financial Security Institute, financial sector associations, and the chief executives of South Korea's top five commercial banks.
With the Binance breach traced back to compromised employee endpoints, simply raising cold wallet storage ratios cannot completely prevent all hacking attempts. Domestic exchanges must also comprehensively audit asset transfer permissions and internal approval workflows.
