Binance hit by $6.3bn hack as analysts point to North Korea

Hackers stole about $6.3 billion from Binance hot wallets on Oct. 29, in what analysts say may be the largest crypto theft on record, according to Reuters’ report. Binance said it would cover the losses and that customer funds were safe.

TRM Labs and Chainalysis pointed to North Korea-linked group TraderTraitor, Reuters reported. The attribution remains an assessment by blockchain intelligence firms; Binance said it was working with law enforcement to identify those responsible.

How did the attackers get into Binance’s wallets?

Binance co-CEO Richard Teng said attackers manipulated a system used to approve transactions, moving funds from an internet-connected wallet without passing normal approval controls. The exchange initially cited a potentially compromised laptop, then said its investigation had found additional points of breach.

Blockchain firm Elliptic’s analysis of the incident said wallets across 11 blockchains were drained over several hours. It reported that the largest losses came from Ethereum, including $1.9 billion in USDT and $823 million in USDC.

How much has been frozen, and who will cover the loss?

Binance said about $3 billion in affected assets had been located and frozen with partners, Reuters reported. Tether said it froze nearly $1.57 billion linked to the incident, while Circle froze more than $800 million.

Binance said it had set aside about $6.34 billion in company funds to cover the stolen assets. Elliptic estimated that $2.84 billion had been frozen on-chain, while the attacker continued moving some remaining funds between wallets and blockchains.

When could Binance withdrawals resume?

Binance halted withdrawals after the breach. The exchange said on Friday it expected to resume withdrawal services within 48 hours, while its investigation and efforts to trace and recover assets continued.

References

• Reuters’ report — live.euronext.com
• analysis of the incident — elliptic.co