Bitcoin Magazine

Blockchain Firms Link North Korea to $6.3 Billion Binance Hack 

Blockchain analysis firms Chainalysis and TRM Labs have linked the $6.3 billion Binance hack yesterday to TraderTraitor, a unit associated with North Korea. If confirmed at this scale, the theft would be the largest crypto hack on record. 

Chainalysis puts the total at $6.4 billion in its own assessment. Chainalysis says funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29. 

The firm said the attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. 

The attacker then swept assets into addresses under its control. Binance has said its initial investigation points to a compromised engineer’s laptop, which gave an attacker access to a service container and enabled unauthorized withdrawals. 

The exchange said it has found no evidence of a wallet private key leak.

The attacker reportedly tried to outpace freezes by converting stablecoins into ether and other assets that issuers cannot freeze. Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Freezes began by 5:14 p.m. Eastern, according to the firm.

Market reacts to the hack

Bitcoin dropped toward $76,000 on Friday morning before trading near $77,400. Other crypto followed suit and posted declines of their own. Total market liquidations reached $1.5 billion, with bitcoin accounting for $468 million and ether for $358 million. 

Long positions, which bet on higher prices, bore most of the losses. The sell-off coincided with a separate incident at decentralized betting platform Polymarket, which suspended international trading after hackers drained more than $2.6 million from user accounts.

Binance said Thursday that the security incident affected about $6.3 billion in assets, surpassing the $1.5 billion Bybit hack of 2025, which was attributed to North Korean hackers. Former CEO Changpeng Zhao wrote on X, “It does look like a hack.” Zhao no longer runs the exchange but remains a key shareholder.

Stablecoin issuers moved to contain the fallout. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT and that protecting the industry and its partners is its main priority. 

Circle co-founder and CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. First Digital CEO Vincent Chok said FDUSD stolen in the attack has been frozen. Binance says about $3 billion has been frozen onchain in total.

Binance has enough funds to cover the incident

Binance says it has reserved more than $6.34 billion of company funds to cover the incident. About $5 billion of that reserve is held in the same token assets that were affected, and the company is buying the remainder through market and OTC channels. 

The exchange says frozen and protected assets remain subject to verification and plans to publish an updated Proof of Reserves. 

Reuters, citing a person familiar with the matter, reported that Binance is working with the FBI and the U.S. Secret Service.

Bitcoin may have further downside

Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, wrote in an email to CoinDesk that the negative price action may have some way to go. He said a new base will form after assets are unfrozen and more details of the hack emerge. 

Kendrick argued that the incident could accelerate a shift toward decentralized exchanges. Chainalysis has warned that scammers are impersonating the firm, including those offering fund recovery and recruiting services. 

Victims should treat unsolicited recovery offers with caution and rely on official channels for updates.

At the time of writing, Bitcoin is trading near $76,700.

This post Blockchain Firms Link North Korea to $6.3 Billion Binance Hack  first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

Bitcoin Magazine

U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers

The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company, accusing them of helping North Korea collect wages from foreign employers, many of them American, through fake identities and forged paperwork.

The workers are typically placed at legitimate firms under invented personas, sometimes with AI-generated resumes, doctored photos, or deepfake video during interviews. 

Most of their pay goes back to the regime, which Treasury says uses the money to fund its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained access to corporate networks, where they have planted malware and taken proprietary data.

The money and crypto behind North Korean fraud

The sanctions focused less on the workers themselves than on the people who move the money. Two Russian nationals are at the center of the action. 

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. 

Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024. 

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for it since 2025.

Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals, a signal to exchanges and other financial firms to watch for those accounts. One Ethereum address is linked to both Obertas and Boykov.

The action follows a March designation of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties are subject to the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, the advisories from the State, Treasury and Justice departments and the FBI offer guidance on spotting these schemes, including verifying identities, checking where payments are going, and watching for unusual access requests.

This post U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

Bitcoin Magazine

Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled “a list of protocols that were hacked for more than $50,000 in 2026.” 230 protocols year-to-date. “Crypto security is absolutely cooked.” September alone accounted for about $768 million in Muur’s tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.

The largest single loss was Bitget’s September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.

Liquid Network, Blockstream’s Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol. 

Samson Mow later called the episode part of an “avalanche of AI-assisted attacks” that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors. 

DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors. 

KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK’s Lazarus Group, specifically TraderTraitor. 

Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.

Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC. 

Ledger losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents. 

The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.” 

Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. 

OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year’s largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.

Bitcoin’s base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.

This post Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures first appeared on Bitcoin Magazine and is written by Juan Galt.

Bitcoin Magazine

South Korea Weighs Fourth Delay of Crypto Tax, With 2029 Start Tied to U.S. Data Sharing

South Korea’s presidential office is reviewing a fourth postponement of the country’s 22% tax on crypto gains, with a 2029 start date gaining support among lawmakers and industry groups.

The tax is scheduled to take effect January 1, 2027. The presidential office said it is in talks with government agencies about a delay, citing gaps in the regulatory framework and the problem of treating domestic and overseas trades the same way, according to Newsis reporting.

The levy dates to a 2020 amendment to the Income Tax Act. It applies a 20% national rate plus a 2% local rate to annual income from the transfer or lending of virtual assets above a 2.5 million won ($1,888) deduction. The start date was set for 2022, then pushed to 2023, 2025 and 2027 as officials conceded that tax systems and investor protections were not ready.

The U.S. data problem

The argument for 2029 rests on the OECD’s Crypto-Asset Reporting Framework, the standard under which tax authorities swap crypto transaction records with one another. South Korea is among the first group of jurisdictions set to begin exchanges in 2027. The United States does not join until 2029.

A presidential office official told Newsis that the absence of U.S. trading data is the biggest bottleneck. Without it, the National Tax Service would have to chase overseas transactions one by one, and Korean traders on domestic exchanges would carry a heavier burden than those on foreign platforms or in self-custody.

On October 16, Democratic Party lawmaker Park Min-gyu and 13 colleagues filed a bill that would push the tax to January 1 of the second year after the first international data exchange, which works out to 2029. People Power Party lawmaker Song Eon-seok filed a separate bill to strike the crypto tax provisions from the law.

The Korea Digital Asset Business Association backed the 2029 date Thursday and asked the government to pass a digital asset law with stock-market-grade investor protections before any tax takes effect.

A tax fight that has been building

The pressure has come from several directions at once. Last week, two public petitions, one to repeal the tax and one to defer it two years, each cleared the 50,000 signatures that force a legislative review. Democratic Party leader Kim Min-seok called for a “thorough final review,” a shift for a party that had held the line on 2027.

Finance Minister Lee Hyeong-il told a parliamentary audit Thursday the government would decide “after carefully considering and gathering all opinions from the industry and the National Assembly.” Financial Services Commission chairman Lee Eog-weon said the same day that the tax should “take various circumstances into full consideration.”

The Virtual Asset User Protection Act took effect in July 2024, but the Digital Asset Basic Act, the licensing framework flagged alongside spot bitcoin ETF approval, has not passed. Lawmakers have questioned taxing a market before the law defining it exists.

The National Tax Service has not slowed down. It plans to publish a draft notice on taxable crypto income by the end of October. The government expects to settle its position through inter-agency talks after audits wrap, with a decision through National Assembly tax revisions between late November and early December.

This post South Korea Weighs Fourth Delay of Crypto Tax, With 2029 Start Tied to U.S. Data Sharing first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

Bitcoin Magazine

Bank of Korea Wants Stablecoins Written Into Forex Law as Crypto Bill and Tax Fight Come to a Head

The Bank of Korea plans to draft an amendment to the Foreign Exchange Transactions Act with the government before year-end that would regulate stablecoins as a means of payment, according to a written submission to the National Assembly’s annual audit reported by Korean outlet Digital Asset.

The central bank’s October 22 report, a follow-up to last year’s audit, says it is consulting with the government on measures to regulate cross-border transactions in virtual assets. 

While building a monitoring system based on foreign exchange network reporting, the bank said, it plans to prepare the amendment with the government this year to regulate stablecoins as a means of payment, among other aims.

That is a plan to write a bill, not a bill in itself. There is no draft text, no named token and no passage date. And “means of payment” is a defined term in Korean forex law: an instrument whose cross-border movement must be reported. 

On that reading, the amendment would put dollar stablecoins under the same controls as a wire to New York, not make them legal tender at a Seoul convenience store.

The BOK pointed to settlement outside the banking system, mixers and regulatory gaps around personal wallets as factors that ease illegal transactions. Bitcoin holders who self-custody in Korea should take note: the country’s capital controls are the reason the kimchi premium exists, and a tighter forex net around crypto would entrench those controls rather than ease them.

The forex work runs in parallel with the Digital Asset Basic Act, the licensing and stablecoin-issuance framework flagged alongside spot bitcoin ETF approval in the government’s 2026 growth strategy. 

Financial Services Commission chairman Lee Eog-weon told lawmakers Thursday that consultations are in their final stage and the bill will follow as soon as possible, Bloomingbit reported. 

The BOK said it will work with ministries to limit transactions that exploit the gap until that law exists.

South Korea’s crypto tax discussions

The gap has a date attached. Korea’s crypto income tax is due to take effect January 1, 2027, according to The Block, after three postponements, and lawmakers have questioned taxing a market before the law defining it is passed. 

Lee said Thursday the tax should “take various circumstances into full consideration,” per Yonhap. Democratic Party leader Kim Min-seok called Thursday for a “thorough final review,” a shift from a party that had insisted on 2027. 

Two petitions, one to repeal the tax and one to defer it two years, each cleared the 50,000 signatures that force a legislative review. 

The National Tax Service has not moved: it plans to finalize its draft tax notice by October 30, Digital Asset reported.

This post Bank of Korea Wants Stablecoins Written Into Forex Law as Crypto Bill and Tax Fight Come to a Head first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

Bitcoin Magazine

South Korean Lender Jeonbuk Bank to Offer Bitcoin-Backed Loans

Jeonbuk Bank has become the first bank in South Korea to offer won-denominated loans backed by bitcoin, according to reports. 

The subsidiary of JB Financial Group has started offering the loans, according to exclusive Monday reporting by the country’s Edaily paper. 

For now, the product is limited to corporate customers raising working capital, and bitcoin is the only eligible collateral. The bank said it may expand the service depending on regulatory changes and market demand, the report added. 

JUST IN: South Korea's Jeonbuk Bank will offer the first ever bitcoin-backed won loans for clients pic.twitter.com/jXbIPsejWU

— Bitcoin Magazine (@BitcoinMagazine) October 12, 2026

Jeonbuk Bank won’t own or control the bitcoin itself. The collateral is held by a specialized custodian, limited to virtual asset service providers registered under Korea’s Act on the Reporting of Specific Financial Information, it further noted. 

If a borrower defaults, the bank won’t take the coins but will rather liquidate them through enforcement procedures such as a court-ordered sale and recover the loan from the proceeds.

The bank said it chose bitcoin for its market capitalization and trading volume, the largest of any digital asset, and that its own stress tests showed bitcoin held up as collateral even during sharp price declines. To value the collateral, it uses an index based on a weighted average of prices across multiple global exchanges.

Similar products already exist abroad. JPMorgan Chase debuted bitcoin-backed loans for institutional clients in March, and Switzerland’s Sygnum Bank offers comparable credit.

The loan is the first concrete result of the “Crypto Bank” vision put forward by Jeonbuk Bank President Park Chun-won. The lender is the only regional bank to provide real-name verified accounts to crypto exchanges, and it is preparing an “all-in-one wallet” that combines fiat accounts and digital asset wallets.

“This loan is an example of designing a risk management and recovery structure that allows us to utilize existing bank lending and collateral management systems without directly holding virtual assets,” said Jeong Sang-hoon, executive vice president of the bank’s digital division.

This post South Korean Lender Jeonbuk Bank to Offer Bitcoin-Backed Loans first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Bitget Customers Withdraw Over 4,000 Bitcoins in One Hour Following $388M Hack

Investors withdrew over 4,000 bitcoins worth over $334 million at today’s prices in one hour after hacked Bitget resumed customer withdrawals, the company’s CEO has said. 

Bitget CEO Gracy Chen told Bloomberg Television Tuesday that withdrawals from the exchange had since stabilized following the immediate bitcoin transactions.

Hackers last week made away with $388 million in crypto after targeting the Victoria, Seychelles-based exchange’s hot wallets. 

“The withdrawals actually stabilized a lot today,” Chen said. “Those hundreds of millions [in bitcoin withdrawals] actually most of them happen on the first hour of the withdrawal restart.”

In a Monday X post, Chen said that 9,585 orders of 4,098 bitcoins were processed. The exchange is allowing customers to withdraw funds in phases. 

Bitget froze withdrawals after blockchain experts flagged that money was leaving the exchange. Bitget later said the attack method in the incident was “highly consistent with known patterns of North Korean hacker organizations.” 

Chen said that no cold storage funds were touched but rather attackers had “exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls.” 

She added that the company was using its own money to top up its protection fund after it dropped in size. Bloomberg reported that it was below $200 million after standing at $464 million before the hack. 

Bitget said that it was the first “security incident of this nature in eight years.” 

“The incident remains contained, and no further unauthorized transfers are possible,” the exchange noted. 

Bitget is the sixth biggest by trading volume, according to CoinGecko, processing in the past 24 hours $811 million in transactions. The exchange’s customers are mostly based in Asia. 

Attackers linked to North Korea’s government have long targeted crypto exchanges and are some of the most sophisticated cyber criminals out there. 

This post Bitget Customers Withdraw Over 4,000 Bitcoins in One Hour Following $388M Hack first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

💾