Binance breach: Hackers drain over $6 billion in 20 minutes

Binance, the largest cryptocurrency exchange globally, confirmed on Friday that hackers stole more than $6 billion from its wallets. The incident appears to be the largest single theft of digital assets on record. The company stated it has set aside more than $6.34 billion in internal funds to cover the missing money.

Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a hacking unit based in North Korea. TRM stated that an attacker moved approximately $6.36 billion across ten different blockchains in about 20 minutes. The firm noted that several technical features of the breach matched earlier heists linked to North Korea. Chainalysis, another analysis company, reached a similar conclusion regarding the likely perpetrator.

Richard Teng, co-CEO of Binance, said the company is working around the clock to resolve the issue. He confirmed in a video posted on X that the company's hot wallet, which holds user assets connected to the internet, was targeted. Teng explained that the vast majority of user assets remain in cold wallets, which are offline and used for secure storage. Withdrawals from the platform have been suspended and are expected to resume within one to two days.

The suspected involvement of North Korea aligns with a long-standing pattern of cyber theft. South Korea's spy agency reported in December 2022 that North Korean hackers stole an estimated $1.1 billion in virtual assets over the previous five years. Analysts suggest North Korea uses these illicit funds to support its economy and nuclear program in the face of United Nations sanctions.

Garrick Hileman, an independent cryptocurrency analyst, observed that while roughly $3 billion in affected assets have been frozen, hackers are already transferring and converting the rest. He compared the process to money laundering, where stolen digital goods are mixed through tumblers to obscure their origin. This makes tracking the remaining funds more difficult for investigators.

Kok Tin Gan, co-founder of cybersecurity firm NyxLab, pointed to a specific vulnerability in the breach. He said the attack appears to have utilized a single signature that granted the attacker a full-access token with no expiration date to the hot wallet. Teng said the attack was not carried out by one person and involved complex tactics, including a self-destruct mechanism that complicates the investigation.

Binance stated that an initial investigation suggested a compromised laptop played a role, but further probing uncovered additional points of breach. The company is working with law enforcement partners to identify the criminals. Changpeng Zhao, Binance's founder, noted on X that while this is the largest theft in dollar terms, previous attacks like the one on Mt. Gox affected a larger amount of bitcoin.