Billions were moved in about 20 minutes. Now specialist investigators have pointed to a familiar suspect behind the record-breaking raid.
North Korean hackers have been blamed for today’s $6.3 billion (A$$9 billion) Binance raid, with specialist investigators identifying the same group responsible for similar breaches.
US blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. The firm has cited its analysis of cryptocurrency transactions and came to the bombshell conclusion that Friday’s catastrophe was state sponsored.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the firm announced on Friday afternoon (AEDT).
TRM says billions in crypto assets were moved from Binance wallets across ten blockchain networks in just 20 minutes. It says several features match earlier North Korean heists, including preparations well before the theft and transaction authorisations obtained in advance.
Binance has not yet publicly identified their attackers, only announcing that A$4.3 billion in assets had been frozen and that help was on the way.
The trading giant is stressing to its customers that it will eat the losses using its emergency SAFU fund and company money.
Co-founder Yi He now says withdrawals are expected to begin resuming within 48 hours, with deposits operating normally.
“We are working non-stop to resolve this issue. Binance will cover all losses,” the company said.
Laptop under scrutiny
According to a Binance Telegram statement reported by CoinDesk, the preliminary investigation points to a compromised laptop belonging to a DevOps engineer, whose work involves the technical systems underpinning the business.
The attacker may then have accessed an internal service and submitted unauthorised withdrawals.
“We have found no evidence of any wallet private key leak,” Binance said.
If you’re interested in finance, check out our new Stress Tested podcast on YouTube, or your podcast platform of choice
The preliminary explanation suggests attackers may have manipulated the systems approving transfers rather than simply stealing individual credentials.
Binance has promised its customers a detailed technical account once the facts are verified.
Race to lock down billions
The response has become a race between companies trying to freeze assets and an attacker moving them through the sprawling cryptocurrency economy.
Tether chief executive Paolo Ardoino said his company froze more than US$1.5 billion (A$2.2 billion) worth of assets linked to the potential Binance hack.
“Protecting the industry and our partners is our main priority,” he wrote.
Arbitrum’s Security Council also intervened, freezing roughly $30.5 million (A$43.4 million) in assets linked to the attacker.
The disruption has also reached cryptocurrency lending platform Aave, whose risk team says it froze new deposits and borrowing across 292 token reserves.
The team says the attacker’s existing loan position does not endanger Aave suppliers.
“Markets will stay frozen until the exploiter’s funds stop moving and we get more clarity on the containment from Binance’s side,” LlamaRisk wrote.
Crypto confidence takes another hit
Bitcoin has predictably taken a tumble in the hours following the hack.
The popular asset has fallen roughly 5 per cent, sliding below $77,000 (A$109,600) on Friday afternoon AEDT.
Binance-linked token BNB meanwhile lost about 8 per cent, while Ether fell around 5.7 per cent.
Wintermute chief executive Evgeny Gaevoy argued Binance could absorb the blow, despite the obvious PR nightmare.
“Binance has enough to withstand 3-4x of current hit and still be largely intact,” he posted.
His firm disclosed Binance exposure below 20 per cent of its net equity. Rival trading firm GSR put its exposure below 5 per cent and said it did not anticipate material disruption.
More to come.