Binance, the world’s largest cryptocurrency exchange, said Friday that hackers stole more than $6 billion in what appears to be the largest cryptocurrency heist on record. Blockchain companies pointed out that the attack came from a North Korean hacking unit.
The company said it had set aside more than $6.34 billion in funds to cover stolen assets and was beginning to recover user assets. Binance worked with blockchain partners to freeze about 3 billion dollars in the assets concerned.
The cryptocurrency exchange has promised to cover any losses and regularly shares updates on its social media channels as it uncovers more information about the hack.
“We are working around the clock to resolve this issue,” Binance co-CEO Richard Teng said in a video posted to X on Friday.
In an exchange with reporters at the White House on Friday, President Donald Trump said U.S. officials were investigating the Binance hack. Asked if North Korea was involved, Trump replied: “We’re looking into that.”
Here’s what we know about the hack, possible North Korean involvement, and Binance’s investigation.
North Korean hackers suspected of involvement in attack
Binance said on
US blockchain intelligence firm TRM, in a post on its website late Thursday, attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit. “We make this judgment with complete confidence,” the company said.
“An attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, most in approximately 20 minutes,” TRM said. “Several features of this attack are consistent with previous heists linked to North Korea. »
Blockchain analytics firm Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and CEO Jonathan Levin wrote on X.
When asked about potential ties to North Korea, a Binance spokesperson would only say that the company is “working closely with our law enforcement partners to confirm the identities of the criminals and bring them to justice.”
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of essential foreign currency to support its ailing economy and finance its nuclear program following severe UN sanctions and other difficulties.
In December 2022, South Korea’s intelligence agency said that North Korean hackers had stolen approximately 1.5 trillion won ($1.1 billion) worth of cryptocurrencies and other virtual assets over the past five years, with more than half of that in 2022 alone. North Korea’s ability to steal digital assets is considered one of the best in the world.
Many are calling this the largest crypto theft on record.
Even though about half of the stolen assets have been frozen, there is evidence that hackers are already transferring and converting some of what hasn’t been recovered, said Garrick Hileman, an independent cryptocurrency analyst.
“Like money laundering, you bring back the stolen goods and launder them using a blender or tumbler,” he said. “You mix it with other cryptos, and it’s harder to track.”
How long it will take for hackers to turn this into something usable is unclear, he said. “Ultimately, there are places in the world where you can take your bitcoin and convert it,” Hileman said.
TRM and several other companies and crypto experts said the hack represented the largest cryptocurrency theft on record.
In February last year, another cryptocurrency exchange, Bybit, suffered a loss of $1.5 billion when it was hacked. The FBI said North Korea and TraderTraitor were responsible for the hack. TRM listed the Bybit hack when referring to the similarities between the Binance hack and previous TraderTraitor-related attacks.
The founder of Binance, Zhao Changpengwrote on X that while the Binance hack might be the largest in terms of monetary value, previous attacks on other companies like crypto exchange Mt. Gox have had a more substantial impact in terms of the amount of bitcoin affected, he said.
Experts warn that this scale of hacking could become more common.
“A cyberattack of this level is a question of when, not if, especially in the context of the rise of AI,” said Andy Ward, senior vice president of Absolute Security. “Cyber threats are becoming more sophisticated and widespread, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines. »
Where experts – and Binance – say things went wrong
The hack raised questions about why tighter approval controls weren’t in place, said Kok Tin Gan, co-founder and CEO of cybersecurity firm NyxLab.
“This looks like a signature that gave the attacker a full, non-expiring access token to a Binance hot wallet,” he said, referring to cryptocurrency wallets that hold users’ unique “private keys,” or permissions, digitally and connected to the Internet.
Teng, co-CEO of Binance, confirmed in a nearly five-minute video posted on Friday that Binance’s own hot wallet was affected. “User assets are held within Binance’s established security architecture,” he said. “The vast majority are in cold wallets” – which are offline and used for secure storage – “and are only moved to a hot wallet when a user makes a withdrawal.”
Teng said Binance’s technical and security teams were “still investigating the hack.” He said the attack was not carried out by a single person and that the attackers used complex tactics, including a “self-destruct mechanism” that made investigating the incident more difficult.
“We are working with law enforcement, blockchain intelligence companies, token issuers and other exchanges to trace and recover stolen funds,” Teng said. “We will do everything in our power to ensure these bad actors are held accountable.” »
Binance said deposits were unaffected, while withdrawals have been suspended and are expected to resume in a day or two.
___
Associated Press writers John Seewer and Aamer Madhani contributed to this report.
Gn headline
