Binance suspended all deposits and withdrawals after hackers drained around $6.3 billion in cryptocurrencies from its wallets, leaving the exchange and other crypto firms to try to stop funds moving further.
The attack began at around 4pm ET on Thursday, shortly after 2000 GMT, and targeted Binance wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana. Most of the cryptocurrency was taken in around 20 minutes on 29 October, in a theft described as the largest in crypto history.
Preparation began at least 36 hours earlier, according to the blockchain analysis firm TRM Labs. The firm said the attackers compromised Binance’s signing infrastructure, the system that authorises transactions.
The stolen assets were spread across multiple blockchains. Binance initially said the security incident may have involved a compromised laptop, then said its investigation had identified further points of breach.
Three crypto tracing firms have potentially linked the attack to North Korean hackers. The methods appear to resemble those used by TraderTraitor, an elite subset of North Korean hackers that the FBI previously named as responsible for the $1.5 billion hack of crypto exchange Bybit.
Tom Robinson, chief scientist and cofounder of Elliptic, said North Korea was likely responsible. If that attribution proves correct, he said, the theft “would almost double everything the regime has stolen in crypto to date”.
Crypto companies and exchanges have frozen around $2.8 billion, or around 44 percent of the stolen total. That amounts to around half of the funds.
The remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which cannot be frozen, Robinson said. Major stablecoins, including Tether’s USDT and Circle’s USDC, can be frozen remotely by their issuers.
Binance operates a secure asset fund for users with a $1 billion bitcoin reserve. Its co-chief executive, Richard Teng, said the fund and the company’s own resources would cover losses.
Comments (0)