Binance freezes $3B after massive theft

Binance, the largest cryptocurrency exchange globally, confirmed on Friday that hackers extracted more than $6 billion from its systems. The event stands as the largest cryptocurrency theft recorded to date. The exchange has reserved over $6.34 billion in company funds to cover the loss and began recovering assets for affected users.

Blockchain intelligence firms have identified the perpetrators as likely members of a North Korean hacking unit known as TraderTraitor. TRM, a U.S.-based firm, stated it made this judgment with high confidence. TRM reported that attackers moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the transfer occurring within 20 minutes.

Chainalysis, another major blockchain analysis company, reached a similar conclusion. Its co-founder and CEO, Jonathan Levin, wrote on X that the attack likely involved TraderTraitor. A Binance spokesperson noted the company is working closely with law enforcement partners to confirm the identity of the criminals.

The suspected North Korean involvement aligns with recent trends in illicit cyber activity. Experts note that North Korea has increasingly turned to crypto hacking to generate foreign currency. This revenue supports its economy and nuclear program amid tough U.N. sanctions. In December 2022, South Korea's spy agency reported that North Korean hackers had stolen an estimated 1.1 billion dollars in digital assets over five years.

Binance stated that an initial investigation pointed to a compromised laptop, but subsequent reviews uncovered additional points of breach. Co-CEO Richard Teng confirmed in a video posted to X that the company's hot wallet was affected. He explained that user assets are typically held in cold wallets, which are offline and secure. These assets move to hot wallets only when a user initiates a withdrawal.

Teng described the attackers as using complex tactics, including a self-destruct mechanism that complicates the investigation. He emphasized that the operation was not carried out by a single individual. The exchange is working with law enforcement, blockchain intelligence firms, and token issuers to trace and recover the stolen funds.

Cybersecurity experts have raised questions about the internal controls that allowed such a large transfer. Kok Tin Gan, co-founder and CEO of NyxLab, suggested the issue may have been a single signature that granted the attacker a never-expiring, full-access token to a hot wallet. This type of wallet holds private keys digitally and remains connected to the internet, increasing its exposure to online threats.

Binance has suspended withdrawals for the next day or two while it stabilizes its systems. Deposits remained unaffected during the incident. The company promised to cover all user losses and continues to share updates on its social media channels as it uncovers more details about the breach.

Analyst Garrick Hileman noted that while half of the stolen assets were frozen, hackers are already transferring and converting the unrecovered portions. He compared the process to money laundering, where stolen goods are mixed through tumblers to make tracking difficult. The time required to convert these assets into usable currency remains unclear.

The incident follows a similar attack on Bybit in February of last year. That hack resulted in a $1.5 billion loss, which the FBI attributed to North Korea and TraderTraitor. Binance founder Changpeng Zhao noted that while this hack may be the largest by dollar value, previous attacks on exchanges like Mt. Gox affected larger amounts of bitcoin.