Inside the cyber operation behind North Korea’s suspected $6.3B Binance heist - New York Post
A North Korean hacking unit may have compromised a single Binance employee's laptop to execute the record-breaking $6.3 billion cryptocurrency heist, potentially using AI-powered techniques or an inside job.
Binance, the world's largest cryptocurrency exchange, initially suggested the digital theft of the century may have centered on an engineer's laptop, later identifying 'additional points of breach' – indicating a complex attack potentially involving multiple perpetrators.
Ido Ben-Natan, CEO of Blockaid which first detected the attack within two minutes, told The Post he wouldn't rule out an inside job, though he believes North Korean hackers most likely leveraged artificial intelligence to exploit unknown software vulnerabilities known as 'zero-day vulnerabilities.'
Growing threat
Crypto hacks have been increasing in both frequency and scale, with approximately $1.2 billion stolen in 255 attacks from July to September – up from $822 million in 222 incidents from April to June, according to blockchain security firm CertiK.
The suspected North Korean group TraderTraitor was also linked to last year's $1.5 billion Bybit heist, which was previously the largest attack in history.
In order to penetrate the network, phishing is one option or getting someone hired at Binance.
Attack methods
Crypto exchanges remain attractive targets for hacking groups like TraderTraitor because digital assets can be transferred globally faster than physical assets with greater anonymity, making recovery more difficult.
Ben-Natan revealed the hackers attempted more than 50 times to breach the exchange before succeeding. Once inside, they drained crypto accounts in just 20 minutes, then rapidly transferred the funds across different networks worldwide.
Richard Teng, co-CEO of Binance, confirmed the hackers used a 'self-destruct mechanism' to hinder investigation and tracing efforts.
Recovery challenges
Hackers typically employ social engineering, software exploits, or a combination of both, often tricking employees into granting access through phishing emails or stealing credentials.
Idan Ofrat, co-founder of Fireblocks, suggested the attack likely involved 'a phishing attempt like a LinkedIn message or email,' adding that proper security practices could have prevented it.
After an attack, hackers quickly launder stolen funds through methods like decentralized lending markets to avoid freezing. While blockchain transactions allow officials to track stolen funds, recovery remains difficult due to the largely unregulated nature of the industry.
Binance has set aside over $6 billion in company funds to cover customer losses and expects to allow withdrawals to resume within two days, though without industry-wide cooperation, stolen digital assets may be gone permanently.
Related
