Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea
The cyber-attack, which the company describes as complex, is believed to be the largest ever of its kind.
This page is Both News's AI analysis of the article, not the article itself. Read the full story on the publisher's site.
Read the original articleBBC News · bbc.co.ukRead Just the Facts8 outlets, left to rightOur verdict
Political lean
0 = center. The further from 0, the stronger the lean (max 10).
Reporting balance
How complete and even-handed the reporting is — separate from which side it leans.
This is a centered, professionally sourced news report with no left/right lean, balancing Binance assurances against law-enforcement and analytics findings plus skeptical legal context. Its main strength is pairing company claims with checkable numbers and counter-voices, especially the FTX parallel and contract warning. Readers should keep in mind that North Korea attribution rests on cited analytics firms, not proven in court, and that coverage of losses remains a company promise, not verified funds.
- Why this lean
- No US left/right framing, sourcing or word choices favoring Democrats or Republicans. Story centers on cybercrime attribution and consumer losses, with company, law enforcement and analytics sources presented without partisan adjectives or premises.
- Framing
- The story is told from the perspective of the victim exchange and investigators trying to trace and recover funds, treating the central questions as who carried out the hack and whether customers will be covered.
Key Findings
- 1Attribution is hedged and multi-sourced rather than asserted as fact: body says believed to be, linked, resembled and high confidence, citing TRM Labs and Chainalysis separately.
- 2Company reassurance is paired with counter-evidence: after quoting your money is safe, and we're covering every loss, article notes FTX parallel and warns promise may not be legally binding with lawyer quote.
- 3Scale is contextualized, not just stated: $6.3bn is compared to $1.5bn Bybit heist in 2025 and to $160bn assets under custody, helping readers judge impact.
- 4Initial company explanation is tracked as evolving: from may have started with a compromised DevOps engineer's laptop to uncovered additional points of breach, showing update rather than hiding change.
- 5North Korea motive is explained with sources and limits: cites sanctions, flow analysis and defector interviews as compelling, while noting North Korea has always denied this.
Who gets a voice
- Richard TengBinance co-CEOCompany incident-response and assurance to customersMain voice
- BinanceWorld's largest cryptocurrency exchange, hack victimFunds being secured and customers will be coveredMain voice
- US Secret ServiceUS federal agency for financial crimesLaw-enforcement recovery and prosecution effortMinor voice
- TRM LabsAI-powered investigations companyAttack resembles earlier North Korean-linked incidentsMinor voice
- ChainalysisCrypto analytics firmHigh confidence North Korea linked to hackMinor voice
- Daniel TunkelLawyer at London-based Edwin Coe law firmCustomer recovery depends on contracts and litigationMinor voice
- Several experts and crypto history watchersUnnamed commentators cited by BBCSkepticism that promise to cover losses is binding, FTX parallelMinor voice
- North KoreaAccused state actor, denies involvementDenial of cybercrime fundraising claimsMinor voice
Loaded language
Moral judgment that presupposes guilt of Lazarus Group before adjudication
Pejorative label for North Korean authorities versus neutral term for a government
Dimension Breakdown
Multiple independent types: Binance/Teng, US Secret Service, TRM Labs, Chainalysis, and lawyer Daniel Tunkel, but no quoted customers and no direct North Korean spokesperson.
Mostly plain attributed verbs like said and linked; two evaluative labels remain: infamous and regime for North Korea.
Amounts given with attribution and context: $6.3bn stolen, $3bn secured, comparison to $1.5bn Bybit heist, 300 million users and $160bn custody to scale the loss.
Hears company assurance, law-enforcement effort, analytics attribution and skeptical experts/lawyers; affected users and North Korea are only summarized, not quoted.
Headline says attempting to recover $6.3bn stolen in hack linked to North Korea, matching body that $3bn frozen and several analytics firms linked it to North Korea.
Provides Binance history, FTX collapse parallel, US jurisdiction explanation, and sanctions motive for North Korea, enough to judge claims without prior crypto knowledge.
Missing Perspectives
- Direct affected Binance customers: no user account of frozen withdrawals or losses, which matters to test whether coverage promise holds in practice.
- Direct North Korean official comment on this specific hack: only generic denial history is given, limiting ability to judge attribution dispute.
- Independent auditor or regulator on Binance reserves: claim it can weather loss rests only on company statements plus skeptical lawyers, without balance-sheet evidence.
Highlighted Passages
“your money is safe, and we're covering every loss”
“This was not carried out by one person.”
“It makes North Korea likely to be the only nation that uses hacking as a way to raise public funds.”
Key Facts
- According to Binance, around $6.3bn was accessed in the hack and about $3bn has been frozen/secured.
- According to Binance co-CEO Richard Teng, the attack was not by one person and involved additional breach points beyond an initially suspected compromised laptop, with a self-destruct mechanism destroying traces.
- According to several analytics firms including TRM Labs and Chainalysis, the hack is linked to North Korea with high confidence, including unit TraderTraitor / Lazarus Group.
- According to the US Secret Service, it is working around the clock to identify, freeze, trace and recover funds and bring criminals to justice; Binance says it is also working with the FBI.
- According to Binance, its US-facing exchange was unaffected, but US-linked assets such as Tether and Circle stablecoins were involved, giving US jurisdiction.
- According to Binance, customer funds are safe and every loss will be covered; deposits remain unaffected after initial suspension.
- According to lawyer Daniel Tunkel, whether customers are covered will come down to their contracts and where Binance can be sued for non-performance.
- Binance was founded in China in 2017, has more than 300 million registered users, and said in 2024 it had more than $160bn in custody, according to the article.
