North Korean hackers carried out one of the largest cryptocurrency thefts to date, valued at more than $6.3 billion, while token issuers and blockchain networks succeeded in freezing around $2.7 billion of the stolen funds, amid major challenges in recovering the remaining amounts.
اضافة اعلان
North Korean hackers seized cryptocurrencies worth $6.36 billion from the Binance platform, according to blockchain intelligence firm TRM Labs.
According to the company's report, the attack took place on October 29 and targeted funds spread across 10 different blockchain networks within only about 20 minutes.
The company attributed the operation to the hacking group TraderTraitor, which is believed to be backed by the North Korean government.
How did the hackers steal $6.3 billion from Binance?
On the Ethereum network, the hackers exploited a mechanism linked to the EIP-7702 technical standard to take control of a Binance hot wallet and convert it into a smart contract under their full control.
The attackers used one authorization out of 50 that had been prepared in advance, after it turned out to match the number of transactions recorded in the targeted wallet.
On the other nine blockchain networks, the hackers moved funds using ordinary transfer transactions digitally signed.
TRM Labs considers it likely that Binance's transaction signing system for its wallets was compromised, though the platform has not yet confirmed the exact method by which the attack was carried out.
According to the report, the group began preparing for the operation at least 36 hours beforehand, conducting test transactions and funding a wallet dedicated to the attack through small withdrawals from the Tornado Cash service.
TRM Labs noted that the TraderTraitor group is also linked to the breach of the Bybit platform last year, which resulted in the theft of around $1.5 billion, making the value of the new attack about four times larger.
The stolen assets included Bitcoin, Ethereum, XRP, Solana, and stablecoins.
For its part, Binance confirmed the security incident, and temporarily suspended withdrawals across several networks, stating that users' funds are safe, while investigations continue to uncover the circumstances of the attack.
How much of the stolen crypto was recovered?
Companies including Tether, Circle, Ripple, and World Liberty Financial succeeded in freezing around $2.7 billion of the stolen funds in a short period.
However, the hackers still hold assets valued at around $2.4 billion, including more than 420,000 units of Ethereum and over 18,000 units of Bitcoin, assets still beyond the control of the parties seeking to recover them.
The attackers have already begun laundering part of the stolen funds, by selling cryptocurrencies that were at risk of being frozen to market makers at discounted prices, and moving the funds across multiple digital wallets in order to conceal their trail and make it harder to track.
TRM Labs expects the next phase of money laundering to involve the use of cross-chain bridges between blockchain networks and cryptocurrency swap services, indicating that the attack's repercussions may continue in the period ahead.
The incident highlights the major security risks associated with breaches of transaction signing systems at cryptocurrency trading platforms, as unauthorized access to these systems can lead to enormous financial losses.
Despite companies succeeding in freezing assets worth billions of dollars, recovering the rest of the stolen funds may prove a major challenge, given the hackers' continued movement of assets and concealment of their sources.
