Investors have fled with billions from cryptocurrency exchange Binance after an unprecedented cyber-heist saw hackers steal nearly $9 billion from the platform.
On Friday morning, Binance watched as hackers siphoned billions of dollars in cryptocurrency from the exchange’s internet-connected ‘hot wallets’ over a span of roughly 20 minutes.
The cyberattack – which US authorities have since pinned on state-sponsored hackers from North Korea – has been described as the largest cryptocurrency heist on record.
Though Binance initially froze customer withdrawals to conduct urgent investigations, the platform started to restore access to funds at approximately 5pm Sunday.
Over the following nine and a half hours, the company processed a wave of more than $6.5 billion (US$4.6 billion) in withdrawals along with some $1.4 billion (US$1 billion) in deposits.
Despite repeatedly emphasising it would cover all losses and user funds were “completely safe”, the company reported a total net outflow of approximately $5.1 billion (US$3.6 billion) – representing some 2.1 per cent of its $243 billion (US$171 billion) in total assets under management.
“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial,” the company said.
“Our team continues testing rigorously the remaining networks and assets.”
“We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can.”
Binance foots the bill
The cyberattack reportedly impacted between 30 and 40 separate cryptocurrency tokens, including heavy-hitters such as Bitcoin, Ether and US dollar-backed stablecoins USDT and USDC.
Binance was quick to declare that the company, not its users, would “absorb the financial impact of these stolen funds”, while co-chief executive Richard Teng stressed that Binance was built to weather a theft of this scale.
“Bottom line – your money is safe, and we’re covering every loss,” Teng said Friday.
Binance said it had already set aside more than $8.9 billion (US$6.3 billion) in company funds and covered some 95 per cent of the hacked losses.
Teng said the company held $7.1 billion (US$5 billion) in impacted assets such as Bitcoin and Ether, while Binance explained that the remaining five per cent of cryptocurrency assets were being re-purchased until the stolen amount is completely covered.
The company has also worked with industry partners to freeze some $4.26 billion (US$3 billion) of affected assets, and has undertaken collaborations with law enforcement, token issuers, blockchain intelligence firms and industry partners to “trace, freeze and recover more”.
“Our team hasn’t stopped,” Teng said.
“We’re working closely with law enforcement to ensure the matter is handled appropriately.”
FBI says North Korea to blame
Binance has not publicly identified those behind the attack, though the US Federal Bureau of Investigation (FBI) has officially accused the Democratic People’s Republic of Korea (North Korea) of being responsible.
“North Korea was responsible for the theft of more than $US6 billion in virtual assets from cryptocurrency exchange Binance,” the FBI said in a statement.
The FBI specifically named ‘TraderTraitor’ – a known, state-backed threat actor that was also allegedly behind a previous $2.1 billion (US$1.5 billion) hack at cryptocurrency exchange Bybit last year.
Prior to Binance’s hack, TraderTraitor’s Bybit incident was deemed the biggest cryptocurrency theft ever recorded.
The FBI said it has observed the threat actor converting stolen Binance assets primarily into cryptocurrency Ethereum, and called on relevant private sector entities to block transactions linked to known TraderTraitor addresses.
“It is expected these assets will then be further laundered by converting them using [decentralised finance] and instant swap services as they prepare them for further laundering stages,” the FBI warned.
Hackers broke into a Binance laptop
In an update shared to X, Teng said the hack was a “complex attack” which may have involved a “compromised laptop” among other points of breach.
Binance said this laptop, which belonged to a DevOps engineer, allowed an attacker to gain access to a service container where they submitted unauthorised withdrawal transactions.
Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said the attack looked “depressingly familiar”.
“The laptop was already authenticated and already privileged, so it became the attacker’s route into production, and from there to the wallets,” said Nandakumara.
Though Binance has not confirmed what initial attack methods were used, Nandakumara said early reports may indicate social engineering tactics were involved.
“To be fair to Binance, nobody stops every social engineering lure, and the post-mortem isn’t out yet,” he said.
“But you don’t have to prevent the first click to limit what it costs you.
“How far one compromised device can reach is an architectural decision, and it was made long before this attack.”
Binance stressed that there was no evidence of customer wallet private keys having leaked during the attack, while the company is expected to release a detailed ‘post-mortem’ report once investigations are complete.
