A hacking group linked to North Korea appears to have gained access to a laptop belonging to a Binance employee, which may have been pivotal in the enormous $6.3 billion heist from the cryptocurrency exchange. This raises the possibility of either an inside job or a sophisticated AI-driven breach of the company’s systems.
Binance, the leading crypto exchange globally, initially pointed to a particular engineer’s laptop as the source of the breach. They later acknowledged discovering “additional points of breach,” indicating a much more complex attack, potentially involving multiple individuals.
Ido Ben-Natan, the CEO of Blockaid, which identified the attack shortly after it occurred, mentioned that he can’t entirely dismiss the notion of an inside job.
“To infiltrate the network, phishing could be one strategy, or they might have found a way to hire someone at Binance,” Ben-Natan explained.
However, he also suggested that the hackers likely employed artificial intelligence, as these models can increasingly pinpoint previously unknown software vulnerabilities in crypto exchanges, facilitating much larger thefts.
There has been a noticeable surge in significant crypto hacks, with about $1.2 billion stolen in 255 incidents from July to September, compared to $822 million in 222 incidents from April to June, according to blockchain security data from CertiK.
The hacking group TraderTraitor, suspected of being behind the Binance attack, was also linked to a $1.5 billion theft from the crypto exchange Bybit last year, which was, at that time, the largest hack on record.
Crypto exchanges are particularly appealing targets for groups like TraderTraitor, as digital assets can be moved around the globe much faster than physical assets, and often with a level of anonymity that makes recovery challenging.
“They made over 50 attempts to breach the exchange,” Ben-Natan stated.
After breaching the systems, the hackers began draining funds from crypto accounts in a swift process that supposedly took only about 20 minutes, and then they quickly distributed the stolen assets to various networks worldwide.
“It’s evident that this attack was orchestrated by North Korea,” Ben-Natan asserted. “Whenever a hack occurs like this, the stolen funds start moving around as fast as possible.”
Richard Teng, co-CEO of Binance, noted on Friday that the hackers “also utilized a self-destruct mechanism, which complicated our trace and investigation efforts.”
Typically, hackers employ social engineering techniques, software vulnerabilities, or a mix of both to achieve their goals.
In many cases, attackers deceive individuals—like employees—into granting them access to confidential systems, perhaps through scam emails or messages. They might also obtain employee passwords or credentials.
Idan Ofrat, co-founder of Fireblocks, speculated that the hackers likely initiated a phishing attempt, possibly through something like a LinkedIn message or an email, adding that proper security measures could have prevented the incident.
Hackers might also exploit weaknesses in an exchange’s blockchain to bypass security features. For instance, they can steal cryptographic keys that authorize transactions, enabling them to shift funds from crypto wallets without needing passwords.
After executing an attack, hackers often rush to launder the stolen money to shield themselves from any losses that could happen if the currencies get frozen. For instance, they may inject crypto into decentralized lending markets. Even if currencies are frozen, they can still secure loans based on the deposited amounts.
Binance stated that it plans to enable customers to withdraw funds within two days and has allocated over $6 billion of its own funds to cover customer losses.
Because blockchain transactions are permanently recorded, officials can track the stolen funds as they travel between wallets and exchanges. Centralized crypto exchanges and stablecoin providers have the ability to freeze assets on their platforms.
Nevertheless, freezing assets doesn’t guarantee their recovery. Given the sector’s relative lack of regulation, reclaiming stolen funds can be a lengthy and complex process requiring collaboration between crypto exchanges, token issuers, and law enforcement.
If such cooperation fails to materialize, it’s likely that those digital assets will be lost forever.
