Hackers Steal $6.3 Billion from Binance in Historic Cyber Heist
Hackers have stolen approximately $6.3 billion in digital assets from Binance, one of the largest cryptocurrency exchange operators. This heist surpasses the previous record for the largest cryptocurrency theft by more than four times. TRM Labs Inc., a venture-backed startup specializing in blockchain intelligence, suspects that both this incident and an earlier attack were orchestrated by a North Korean state-sponsored hacking group known as TraderTraitor.
Nearly 40% of the stolen funds consisted of stablecoins from three major cryptocurrency firms: Circle Internet Group Inc., Ripple Labs Inc., and Tether Ltd. Fortunately, these companies managed to freeze a significant portion of the assets before the hackers could transfer them out of reach. In response to the breach, Binance has allocated over $6.34 billion to compensate affected users.
The theft was executed by compromising multiple wallets associated with the company. One of these wallets supports Binance’s infrastructure for processing customer Ethereum transactions. According to TRM Labs, the hackers infiltrated this wallet late Thursday and redirected its entire balance to a wallet under their control.
TraderTraitor exploited a feature of Ethereum known as EIP-7702, which was introduced by the blockchain’s maintainers last year. This feature allows a smart contract, which is a segment of code, to temporarily take control of a wallet. EIP-7702 activates smart contracts only when they receive permission to execute from the wallet’s operator, typically granted through an encrypted message.
The attackers utilized a malicious smart contract to commandeer Binance’s Ethereum wallet. However, the exact method by which they acquired the required authorization to execute such code remains unclear.
Binance conducted an internal investigation that revealed TraderTraitor had compromised a laptop belonging to one of its DevOps engineers. The firm has also identified “additional points of breach.”
Kobi Sivilya, Chief Information Security Officer at cybersecurity firm Checkmarx Ltd., remarked, “Developer and DevOps machines are close to an organization’s most sensitive systems and contain credentials, tokens, and deployment access. The critical question for any organization is how far an attacker could penetrate from a single compromised workstation. Teams should examine who has access to which systems, ensure that access is appropriately restricted, and assess whether a single machine can reach essential services without additional controls.”
TRM reported that TraderTraitor rehearsed the cyberattack for at least 36 hours prior to the theft. On the morning of Wednesday, the hackers deposited a nominal amount into a malicious crypto wallet. They also ran tests on the code employed in the attack across three different wallets early Thursday.
According to Binance, the malware incorporated a “self-destruct mechanism” designed to erase the tools utilized by the hackers on its infrastructure and any activity logs generated during the breach. This feature complicated the investigation process for the company. Nevertheless, Binance determined that the hackers circumvented the approval workflows employed for processing cryptocurrency withdrawals.
“Organizations that depend on exchanges, custodians, or any vital financial counterparties should assess the continuous visibility they maintain regarding these relationships,” said Rand Davis, Chief Technology Officer at SecurityScorecard. “They should also have a clear strategy for when a counterparty suspends withdrawals or services. Security leaders can leverage this incident to map out their critical third-party relationships, test contingency plans, and remain vigilant for potential phishing and social engineering attacks that often follow significant incidents like this.”
Following the discovery of the breach, Binance temporarily suspended cryptocurrency deposits and withdrawals on its exchange. Deposits have since been restored; however, the withdrawal processing system remains offline, with plans to reactivate the feature on Monday.