What to know about the $6.3B hack on Binance, likely the biggest-ever crypto theft | National News | 2news.com - KTVN

The cryptocurrency exchange has promised to cover all losses and has been sharing regular updates on its social media channels as it uncovers more information about the hack. Binance worked with blockchain partners to freeze roughly $3 billion in affected assets.

Blockchain firms have pointed to the attack coming from a North Korean hacking unit. Binance said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."

North Korean hackers suspected

U.S.-based blockchain intelligence firm TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.

"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said. "Several features of this attack match earlier North Korea-linked heists."

Blockchain analysis company Chainalysis also believed the Binance hack was likely carried out by TraderTraitor, its co-founder and CEO Jonathan Levin wrote on X.

Asked about potential ties to North Korea, a Binance spokesperson said the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Experts say North Korea has turned to crypto hacking as a source of foreign currency to support its troubled economy and fund its nuclear program. In December 2022, South Korea's spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency in the past five years.

Record-breaking theft

While about half of the stolen assets were frozen, there is evidence that hackers are transferring and converting some of what wasn't recovered, said Garrick Hileman, an independent cryptocurrency analyst.

"Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler," he said. "You mix it in with other cryptos, and it's harder to track."

TRM and several other crypto firms have said the hack represents the largest cryptocurrency theft on record.

Binance's founder, Changpeng Zhao, noted that while this hack might be the largest in dollar value, previous attacks like the one on Mt. Gox had a more substantial impact in terms of bitcoin amount affected.

Experts warn this scale of hacking could become more commonplace. "A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward of Absolute Security.

Security failures

The hack has raised questions about why stronger approval controls were not in place. Kok Tin Gan of cybersecurity firm NyxLab suggested "one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet."

Teng confirmed Binance's hot wallet was affected but emphasized that "user assets are held under Binance's established security architecture" with the majority in cold wallets that are offline.

Teng said the attackers used complex tactics, including a "self-destruct mechanism" making investigation more difficult. "We are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds," he said.

Binance has said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two. The exchange's tech and security teams remain "deep" in investigating the hack.