Binance says $6.3 billion stolen in record crypto heist

Binance said Friday that hackers stole about $6.3 billion from its transaction wallets, in what blockchain firms say appears to be the largest cryptocurrency theft on record. The FBI attributed the attack to North Korean hackers; North Korea denied involvement on Tuesday.

• $6.36 billion: moved from Binance wallets, according to TRM Labs.
• 10 blockchains: affected, TRM said.
• About 20 minutes: the time in which most of the funds moved.
• Roughly $3 billion: frozen with help from blockchain partners, Binance said.

Binance said it had set aside more than $6.34 billion in company funds to cover the stolen assets and was beginning to recover them for users. The company has promised to cover all losses.

How did the attackers move the funds?

They drained wallets Binance uses to process transactions. Reuters reported that TRM Labs believes the attackers compromised the exchange’s “signing infrastructure,” the system that authorizes transactions, and used it to instruct the affected wallets to send out funds.

Binance initially said its investigation pointed to a compromised laptop, then reported finding additional “points of breach,” without explaining what they were. The company has not publicly confirmed a complete account of how the attackers gained access.

The attack’s speed left little time to respond. Reuters said blockchain records showed the bulk of the theft began shortly after 20:00 GMT on Thursday and unfolded in about 20 minutes.

Who does the evidence point to?

Blockchain firms suspect TraderTraitor, a hacking group linked to North Korea. In its report on the Binance hack, the Associated Press said TRM assessed the group was responsible “with high confidence”; Chainalysis also said the attack was likely carried out by TraderTraitor.

The FBI later attributed the theft to North Korean hackers, according to AP. On Tuesday, North Korea denied involvement and called the U.S. announcement a provocation. Binance said it was working with law enforcement to identify the criminals, so the attribution remains disputed.

How much can still be recovered?

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets. Reuters reported that about half the stolen funds were stablecoins — tokens designed to track the value of assets such as the U.S. dollar — frozen by issuers including Tether and Circle.

A freeze can stop those tokens from being moved, but it does not automatically return them to Binance. Bitcoin and ether do not have a central issuer that can freeze them. Reuters reported that TRM estimated about $2.4 billion in bitcoin and ether was beyond reach; those assets could be stopped only if they reached a cooperative exchange or broker, or law enforcement obtained the keys.

At $6.3 billion, the reported loss far exceeds the $1.5 billion stolen from crypto exchange Bybit last year. AP noted that Binance founder Changpeng Zhao said dollar value does not tell the whole story: previous attacks, including the Mt. Gox breach, affected more bitcoin. For Binance customers, the immediate question is whether the exchange can make good on its promise to cover all losses while investigators trace the remaining funds.

Sources and documents

• report on the Binance hack — apnews.com