Binance’s initial investigation suggested an engineer’s laptop was compromised, which allowed access to unauthorised withdrawals, but a later update said they had uncovered “additional points of breach”.
Richard Teng, Binance’s co-chief executive officer, said the hack was carried out by more than one person, and the hackers used sophisticated methods to hide their tracks, such as a “self-destruct mechanism”.
On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.
The investigation is ongoing, it added. The US Secret Service said on Friday it is “working around the clock” with private sector partners “to identify, freeze, trace, and recover funds” stolen from Binance.
Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group called The Lazarus Group, also known as TraderTraitor, as the likely culprits.
The Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of $1.5bn on the Bybit exchange last year.
North Korea has always denied involvement in these attacks.
Binance, founded in China in 2017, lets users buy, sell and trade digital assets – it is estimated to have hundreds of millions of users worldwide.
Crypto is a digital asset, which doesn’t exist physically and is instead accessed via digital wallets or computers.
