Binance hit by $6.3bn crypto-currency hack - ITWeb

The exchange says its initial investigation points to a possible compromise involving a DevOps engineer's laptop. The attacker may have used access to a service container to submit unauthorised withdrawal transactions. Binance had found no evidence that wallet private keys had been leaked and would publish a detailed technical postmortem once its investigation was complete.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

Binance will cover all losses from the Secure Asset Fund for Users (SAFU) and the company's funds. SAFU is Binance's emergency insurance fund established to protect users in extreme circumstances. The exchange has temporarily suspended deposits and withdrawals while conducting security checks.

North Korean Connection

Blockchain intelligence firm TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group, based on what it describes as "high-confidence on-chain and off-chain intelligence." The attackers moved funds from Binance wallets on networks including Ethereum, Bitcoin, Tron, XRP Ledger and Solana, as well as Arbitrum, Avalanche, Optimism, Base and Polygon.

TRM Labs' analysis indicates the attackers had prepared for the operation at least 36 hours before executing the theft. On Ethereum, they used a pre-signed authorisation to turn a Binance hot wallet into a mechanism for transferring funds to an attacker-controlled address. The first theft occurred on the XRP Ledger, where five Binance wallets sent 233.46 million XRP to a single attacker address.

Security Implications

The incident highlights the security risks facing crypto-currency exchanges, particularly the potential consequences of compromised systems that authorise transactions across multiple blockchain networks. The scale of the breach raises questions about the effectiveness of existing safeguards against unauthorised withdrawals, even at major exchanges holding billions of dollars in customer assets.

The exchange says approximately $3 billion in affected crypto-currency had been frozen on-chain through collaboration with blockchain partners. "The remaining stolen crypto-currency could be moved through cross-chain bridges, swap services and over-the-counter brokers as the attackers attempt to convert or obscure the origins of the funds," says TRM Labs.