币安遭遇创纪录63亿美元网络攻击并暂停提现 多家机构指向朝鲜黑客Binance Halts Withdrawals After Record $6.3 Billion Theft Linked to North Korea

币安在周四晚间通报称，此次安全事件造成的估计总损失达63亿美元，区块链情报机构TRM Labs测算的受损金额更具体指向约63.6亿美元。监测数据显示，攻击者自币安跨越10条不同区块链的数字钱包中迅速抽离资产，大部分资金转移仅用了约20分钟，被盗规模一举刷新了加密货币行业的历史纪录。

Binance reported late Thursday that the security breach affected an estimated $6.3 billion in assets, with blockchain intelligence firm TRM Labs pinpointing the specific drained sum at approximately $6.36 billion. Transaction tracking showed the perpetrator moved funds directly out of Binance wallets across ten blockchains, executing the bulk of the transfers in roughly twenty minutes and establishing the incident as the largest digital asset theft on record.

为阻止资金外流并排查系统漏洞，币安随即暂停了全平台的提现业务，并对充值服务开展联动安全审查。币安周五表示充值服务未受影响，提现服务因安全检查及与执法机构协作而暂时中止，平台预计提现功能将在未来一至两天内（最晚至周日上午）逐步恢复。

To curb further unauthorized outflows and facilitate forensic reviews, the exchange suspended withdrawal services across the platform while initiating comprehensive security checks alongside law enforcement partners. Binance stated on Friday that deposits remained unaffected, and confirmed that user withdrawals are projected to resume within the next day or two, targeting a restoration by Sunday morning once full system validations are complete.

针对此次入侵的具体技术路径，币安在社交平台通报的初步调查结果显示，事件起因可能涉及一名DevOps运维工程师的笔记本电脑失窃或失陷。攻击者借助这台被入侵的电脑获得了对内部服务容器的访问权限，进而得以绕过常规控制，直接向系统提交未授权的提现交易指令。

Regarding the specific technical mechanics behind the breach, Binance disclosed in initial findings published on social media that the incident appeared to involve a compromised laptop belonging to a DevOps engineer. By gaining control of this machine, the attacker accessed an internal service container, enabling the submission of unauthorized withdrawal requests directly into the transaction pipeline.

平台强调，内部排查并未发现任何数字钱包私钥泄露的证据，调查也尚未将具体操作责任归咎于任何个人。币安联合首席执行官理查德·腾（Richard Teng）在社交媒体上指出，这次入侵并非简单的“一键式”恶意操作，而是一个高度复杂的攻击过程。随着调查深入，币安后续确认黑客不仅通过该工程师电脑渗透，还发现了系统内部存在的其他入侵突破点。

The exchange emphasized that internal audits uncovered no evidence of any cryptocurrency wallet private key leaks, nor has the ongoing inquiry attributed direct responsibility to any specific individual. Binance co-CEO Richard Teng stated on social media that the breach was not a simple one-click action, but rather a complex, sophisticated intrusion sequence. As technical teams probed deeper into system logs, the company confirmed that investigators subsequently discovered additional points of breach beyond the initial engineer workstation.

区块链情报机构TRM Labs基于链上与链下综合情报评估认为，本次攻击是以高度确信由朝鲜国家背景精英黑客组织TraderTraitor实施。网络安全公司Check Point指出，该组织在业内通常被称为Lazarus Group。分析机构强调，此次针对币安的攻击手法的多个特征，与2025年2月加密货币交易所Bybit遭遇的15亿美元盗窃案高度吻合，美国联邦调查局（FBI）此前已正式将Bybit事件归咎于TraderTraitor与朝鲜方面。

Blockchain intelligence firm TRM Labs assessed with high confidence that the intrusion was carried out by TraderTraitor, an elite cyber unit backed by North Korea, drawing on combined on-chain and off-chain intelligence. Cybersecurity firm Check Point noted that this collective is widely recognized across the digital security sector as Lazarus Group. Analysts highlighted that several operational hallmarks of the Binance attack closely align with methods observed in the February 2025 theft of $1.5 billion from cryptocurrency exchange Bybit, an incident the Federal Bureau of Investigation previously attributed directly to TraderTraitor and North Korea.

区块链追踪机构Chainalysis联合创始人兼首席执行官乔纳森·莱文（Jonathan Levin）同样公开表示，本次币安盗窃很可能由朝鲜黑客组织TraderTraitor执行。总部位于新加坡的追踪机构Pangolin Intelligence在比对本次链上活动与既往攻击事件数据后得出一致结论。该机构分析师向CNN表示，黑客组织接下来预计将调动洗钱网络来设法变现被盗资金，追查与拦截这批资产的较量才刚刚开始。

Jonathan Levin, co-founder and chief executive officer of blockchain analytics firm Chainalysis, similarly stated that the breach was likely conducted by the North Korean group TraderTraitor. Singapore-based tracking firm Pangolin Intelligence reached the same conclusion after comparing the real-time transaction activity with telemetry recorded in earlier state-linked operations. An analyst with Pangolin Intelligence told CNN that North Korean operatives are likely preparing to engage external money laundering networks to convert the stolen cryptocurrency into usable cash, warning that efforts to intercept the assets remain in their earliest stages.

在被盗事件发生后，币安协同多方生态伙伴与代币发行方展开链上拦截。截至目前，相关合作机构已成功在链上冻结了大约30亿美元的受影响资产，占被盗资金的将近一半。稳定币发行机构Tether与Circle均证实已在周四执行资产冻结，其中Circle联合创始人兼首席执行官杰里米·阿莱尔（Jeremy Allaire）披露，该公司已冻结了价值超过8亿美元的资产，以此阻断黑客转移资金的路径。

Following the unauthorized transfers, Binance mobilized an emergency containment effort alongside cryptocurrency ecosystem partners and token issuers to restrict the movement of stolen funds. Collaborative actions have succeeded in freezing approximately $3 billion worth of digital assets directly on-chain, representing nearly half of the impacted sum. Stablecoin issuers Tether and Circle both confirmed enacting immediate token freezes on Thursday, with Circle co-founder and chief executive officer Jeremy Allaire stating that his firm froze the equivalent of more than $800 million to halt further illicit transfers.

针对尚未拦截成功的资产与受影响用户，币安方面重申用户资金处于安全保障之下。币安联合首席执行官理查德·腾表示，交易所将动用公司自有资金以及专门设立的投资者保护应急资产基金（SAFU），全额填补本次事件造成的全部损失。币安团队正协同执法部门、区块链情报机构和发行方持续追踪链上资产，力争控制并拦截更多外流资金。

Addressing the assets that remain outside platform control, Binance reiterated that customer balances are fully shielded from loss. Binance co-CEO Richard Teng confirmed that the exchange will absorb the entirety of the financial shortfall using corporate capital alongside reserves from its SAFU emergency asset fund. The exchange stated that its technical units continue to work in close coordination with law enforcement agencies, token issuers, and blockchain analytics firms to trace and freeze additional funds moving across external networks.

在盗窃事件披露后，数字资产市场价格整体走低，比特币在周五承受明显的卖盘压力，交易价格失守78,000美元关口。行业专家指出，尽管多方联合实施的链上冻结措施迅速遏制了部分资金流动，但被盗资金的最终追回仍面临漫长且复杂的法律机制考验。

Digital asset markets retreated following news of the multi-billion-dollar breach, with Bitcoin facing sustained selling pressure on Friday as its price slipped below the $78,000 threshold. While industry partners acted rapidly to lock down affected tokens on-chain, legal and compliance analysts warned that recovering the pilfered holdings presents steep procedural hurdles that extend far beyond initial technical halts.

区块链情报机构TRM Labs全球政策主管阿里·雷德博德（Ari Redbord）分析指出，链上冻结仅能阻止资金被转移，返还资金则完全依赖后续的法律程序。稳定币由于发行方控制代币智能合约，Tether与Circle能够依据法院命令或扣押搜查令执行冻结、销毁并重新铸造代币，属于加密生态中最易追回的资产类别。相比之下，比特币与以太坊等去中心化代币缺乏能够直接执行冻结的中心化发行主体。Chainalysis研究主管埃里克·贾丁（Eric Jardine）表示，追查人员必须持续追踪公链流动轨迹，只有在资金流入配合调查的中心化交易所时才能实施拦截，资金返还往往需要执法机构与各平台耗费数月甚至数年时间进行协调。

Ari Redbord, global head of policy at TRM Labs and a former U.S. federal prosecutor, explained that freezing cryptocurrency merely halts on-chain transfers, whereas full asset restitution requires formal judicial processes, such as obtaining court seizure warrants before token issuers can reissue balances to legitimate owners. Centralized stablecoins represent the most recoverable asset category because companies like Tether and Circle control smart contracts and can freeze, burn, and reissue tokens. In contrast, recovering decentralized assets like bitcoin and ether is substantially more complex because no central issuer exists to stop their movement directly. Eric Jardine, research lead at Chainalysis, emphasized that investigators must monitor public ledgers and intervene only when funds flow into cooperating exchanges, warning that cross-entity coordination across law enforcement and trading platforms can take months or years.