Binance hack: What we know about £4bn crypto heist - The Independent
Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.
Cryptocurrency worth more than $6.3billion (£4.7bn) has been stolen from a major exchange, and has been labelled “the largest bank heist in human history” by one insider.
The hack targeted Binance, one of the world’s biggest crypto trading platforms, which has said it’s trying to get to the bottom of it as a matter of urgency.
Deposits and withdrawals have been suspended for customers, but the company maintains that users funds are safe and all hacking losses would be covered.
Reports of a hack began surfacing on X early Thursday afternoon, when crypto observers pointed to large amounts of currency moving out of wallets associated with Binance.
Not long after, the company’s founder Changpeng Zhao confirmed the heist.
In a post on Thursday evening, Binance said the hacker appeared to have gained control of a laptop belonging to a contractor or employee.
Binance said that “the initial investigation suggests that the security incident may involve a compromised Dev0ps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions”.
Director of FinCrime at Wirex, Paul Chapman told The Independent: “Any business that holds a lot of value will be targeted, and crypto platforms are no different.
“Criminals like digital assets because they can move stolen funds quickly and across the border. Attackers look for a way in through people, devices and access controls, which is why a platform’s own internal security matters so much.
“Some of the groups behind these attacks are very well organised and funded, so platforms need to be just as determined in keeping them out.”
Invest at least £100 in Stocks or ETFs of your choice. Get fractional shares worth £50!
Invest at least £100 in Stocks or ETFs of your choice. Get fractional shares worth £50!
US Blockchain analysis lab TRM Labs has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit based on-chain and off-chain intelligence.
TRM Labs said the Binance attack shared characteristics with previous incidents linked to North Korea, including preparations made well before the theft and transaction signatures obtained in advance.
“An attacker moved approximately $6.36billion out of Binance wallets on ten blockchains, most of it in about 20 minutes,” TRM Labs said in a blogpost on its website.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on rob use on and off-chain intelligence. We make this judgment with high confidence.”
Experts say North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough U.N. sanctions and other difficulties.
In December 2022, South Korea’s spy agency said North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets in the past five years, more than half of it in 2022 alone.
It said North Korea’s capacity to steal digital assets was considered among the best in the world.
Early reports suggest the hacker took $1.5billion (£1.17billion) in Bitcoin and around the same in the stablecoin Tether.
Slightly under a billion dollars worth of Ethereum was taken too as well as the same amount in the USDC stable coin.
It is likely, however, that the hackers stole a number of other currencies too.
Zhao posted Thursday on X that “User funds are safe!” but added that the theft “does look like a hack on Binance.”
He added that while he doesn’t manage Binance anymore, “as a shareholder, I expect all user funds will be fully covered.”
On Thursday, Binance said it would cover the losses from the apparent hack.
The event, meanwhile, also raises questions on why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
“This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” he said, referring to cryptocurrency wallets that hold users' “private keys,” or unique authorizations, digitally and which are connected to the internet.
Binance said on X it had “found no evidence of any wallet private key leak” and that the company would release more technical details when its probe is complete.
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress told The Independent: “Binance has pledged to cover all user losses, so immediate financial exposure for Binance customers appears contained.
“But withdrawals have been suspended while the investigation continues, meaning access to funds is restricted right now. Anyone with significant holdings on Binance should monitor official communications closely and not rely on social media for updates.”
Nerves have been frayed by the record-breaking hack at Binance, which, as a result drove down bitcoin (BTC) and other cryptocurrency prices.
Bitcoin, which is the world’s biggest cryptocurrency, hit a six-week low before cutting losses to trade 1.1% lower at $77,876.
"I suspect the negative price action still has some way to go," said Geoffrey Kendrick, head of digital assets research at Standard Chartered. "Only after assets are unfrozen and more detail of the hack emerges will we find a new base."
Patel added: “Standard Chartered has warned further downside is possible until the full picture emerges and frozen assets are released.
“Historically, major exchange hacks cause short-term price drops followed by recovery once confidence returns, but the scale of this incident makes the recovery timeline less predictable than previous events.”
Short term impact on the wider crypto market could include some “nervousness and price swings”, according to Chapman.
“Longer term, regulators will look harder at how platforms store customer assets and control who has access to their systems, and that’s a good thing,” Chapman told The Independent.
The incident could also increase scrutiny of security standards expected from a major digital-asset business like Binance.
Alex Ferrer, Head of Blockchain Forensic Investigations at Crypto Legal, said the hack “may also accelerate institutional demand for independently verified custody arrangements, stronger transaction controls and more transparent security reporting”.
“Ultimately, the industry’s credibility will depend on its ability to prevent these incidents and respond effectively when they occur,” Ferrer added.
Chapman explained the best measures are the simple ones: “Use a strong password that you don’t use anywhere else, and set up two-factor authentication through an app rather than by text message.”
Users should be suspicious of any messages they weren’t expecting, especially one that mentions the Binance hack.
“If you hold larger amounts [of crypto], a hardware wallet is worth considering, as long as you keep the recovery phrase written down somewhere safe and offline,” he added.
Patel stresses the important of the same measures, saying these are the “three things that matter most”.
The cybersecurity advisor adds: “Never store your seed phrase digitally, write it down and keep it physically secure. These aren’t advanced measures. They’re the basics that most people skip.”
