Key Takeaways
- • Binance, the world's largest cryptocurrency exchange, suffered a $6.3bn theft that Elliptic says is likely the largest known theft of any kind, more than four times the previous record crypto hack, the $1.5bn Bybit theft.
- • Elliptic and two other crypto analysis firms attribute the attack to North Korea, specifically a hacking unit called TraderTraitor, which the US government named and which emerged from the Lazarus group.
- • The attack did not crack private keys; attackers compromised an engineer's laptop and other points of breach, then made Binance's systems sign transactions sending funds to the attacker, with more than $2.5bn taken in a single transaction.
- • Binance says it will repay all users from its own funds and has frozen about half the targeted funds, but users are not covered by formal deposit protection in the US, UK or Australia.
- • Chainalysis describes laundering patterns as never seen before, and the laundering process is expected to take weeks, months or longer.
Summary
Binance, the world's largest cryptocurrency exchange by daily trading volume (about $95bn a day), has been hit by a $6.3bn heist that Elliptic, a consultancy specialising in crypto-related crime, says could be the largest theft of any kind on record. Elliptic's chief scientist, Tom Robinson, said the incident is "almost certainly the single largest known theft of any kind," more than six times the $1bn Saddam Hussein is reported to have taken from the Iraqi central bank in 2003.
According to the article, the attack did not appear to involve compromised private keys. Instead, a Binance engineer's laptop was infiltrated, and Binance later said there were "additional points of breach" in its systems. The attackers then caused Binance's own systems to sign transactions that moved funds to them. More than $2.5bn of the total was taken in one transaction. Binance has said it will cover all losses from its own funds and that user funds are safe; it has also frozen about half of the targeted funds.
The attack has been attributed to TraderTraitor, a North Korean unit named by the US government that emerged from the Lazarus group, part of North Korea's Reconnaissance General Bureau. Elliptic said some of the stolen funds have already been traced to wallet addresses used in a cryptoexchange hack last month that is also believed to be North Korean. Sophos's Rafe Pilling said crypto is less regulated and easier to move and launder, making it an attractive target. Chainalysis has described "never seen before" laundering patterns, and Phil Larratt of the same firm said conversion to fiat could take "weeks and months, if not years."
For customers, the article notes that protection comes from Binance rather than regulators. Crypto holdings are not covered by formal deposit protection in the US, UK or Australia, including in a hack or exchange insolvency. By contrast, bank deposits in the UK are protected up to £120,000 per customer per bank and in the US up to $250,000, but only if the bank fails, not if it is hacked and keeps operating.
According to the article, the attack did not appear to involve compromised private keys. Instead, a Binance engineer's laptop was infiltrated, and Binance later said there were "additional points of breach" in its systems. The attackers then caused Binance's own systems to sign transactions that moved funds to them. More than $2.5bn of the total was taken in one transaction. Binance has said it will cover all losses from its own funds and that user funds are safe; it has also frozen about half of the targeted funds.
The attack has been attributed to TraderTraitor, a North Korean unit named by the US government that emerged from the Lazarus group, part of North Korea's Reconnaissance General Bureau. Elliptic said some of the stolen funds have already been traced to wallet addresses used in a cryptoexchange hack last month that is also believed to be North Korean. Sophos's Rafe Pilling said crypto is less regulated and easier to move and launder, making it an attractive target. Chainalysis has described "never seen before" laundering patterns, and Phil Larratt of the same firm said conversion to fiat could take "weeks and months, if not years."
For customers, the article notes that protection comes from Binance rather than regulators. Crypto holdings are not covered by formal deposit protection in the US, UK or Australia, including in a hack or exchange insolvency. By contrast, bank deposits in the UK are protected up to £120,000 per customer per bank and in the US up to $250,000, but only if the bank fails, not if it is hacked and keeps operating.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.