Multiple blockchain intelligence platforms are pointing to North Korea as the culprit behind yesterday’s breach of crypto exchange Binance leading to a $6.3 billion dollar theft that’s being called the biggest digital heist in history.
TRM Labs, Chainalysis and other firms that track on-chain security threats are all pointing with “high confidence” to the hacking group known as TraderTraitor, a U.S. designated state-sponsored advanced persistent threat (APT), for the attack that unfolded Thursday evening.
“This is an extraordinary hack, and it comes down to four things: the size, the speed, the response and North Korea,” TRM Labs Head of Global Policy Ari Redbord said in a statement to the Financial News Network. “When North Korea steals at this scale, the money supports weapons proliferation. This is not just a crypto theft. It is a national security issue.”
Photo by Kanchanara on Unsplash
The U.S. Secret Service and Federal Bureau of Investigations said they are aware of and investigating the incident.
Binance and its founder said that the company would make all affected customers whole again — regardless of the cost to the platform.
The world’s largest crypto exchange first said that the compromise may have come from a sole engineer’s laptop, but now says that there were “additional points of breach.”
"Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds,” the company said in a statement.
The platform said that it had reserved $6.34B of company cash for users after the attack, and that $5B of those funds are already held in the exact token assets that were impacted. The exchange said it will be purchasing the remaining amount by buying token assets through markets and OTC channels.
Binance said about $3 billion in frozen or protected assets are subject to ongoing recovery and verification thanks to companies like Circle, Tether and Ripple moving to freeze funds after word of the hack spread.
“We will weather this storm,” Binance’s statement said.
The hack, which comes as the industry continues to fight for more mainstream adoption around the world and in the U.S. specifically, is the latest in a series of high-profile thefts involving crypto companies. The last attack of this scale affected ByBit and saw $1.5 billion swiped. North Korea was also blamed for the attack.
According to a breakdown of the attack from TRM, the hackers began prepping the scheme at least 36 hours in advance by running three small withdrawals through Tornado Cash, a service that obscures where crypto comes from. It then rehearsed the attacks on three separate wallets before finally installing malicious code on a Binance hot wallet and beginning its attack.
TRM wrote that those responsible stayed ahead of efforts of crypto firms to freeze assets by selling “USDT to market makers and borrowing ETH against USDT on Aave.”
“It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach,” TRM said.
Since yesterday’s hack, Binance founder Changpeng Zhao has attempted to allay fears about the attack’s impact on the exchange and the broader industry.
“🙏🙏🙏 life saver,” he wrote while quoting Tether CEO Paolo Ardoino after the issuer had frozen assets.
“Many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help,” he wrote in another. “It hurts, but we will survive.”
Zhao even took some incoming from Elon Musk, who responded to a post comparing Zhao’s tweets to Sam Bankman-Fried promising that user funds would be given back from FTX.
“Elon, have a lot of respect for you, but bad time to troll. Please stop,” he wrote. “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion,” he continued in the post, referring to SpaceX shares. “Would appreciate if you show a little support. Thanks!”
Binance had said it was on track to return the digital assets within two days, according to the New York Times.
Will Atherton, a financial services lawyer and partner at Reed Smith, a firm that specializes in business law, told FNN that “even if Binance fully reimburses its customers, that does not necessarily insulate it from regulatory scrutiny or potential litigation.”
“Regulators will want to understand how the compromise occurred, whether Binance maintained appropriate cybersecurity and custody controls, and whether it responded appropriately once the breach was discovered,” Atherton said.
He noted that a successful hack does not automatically establish negligence or a regulatory violation. He also pointed out that reimbursing customers doesn’t necessarily eliminate liability.
“Making customers whole would go a long way toward limiting Binance's potential exposure,” he said. “But it would not necessarily close the book on the incident.”
