The world’s largest cryptocurrency exchange has been hit by a $6.3bn heist that, according to experts, is likely to be the work of North Korea.
This is not the first time a crypto market has been targeted by hackers, and the rogue state has a track record of this type of theft. Here we answer some key questions about what’s happened:
Just how big a deal is this?
It could be the biggest heist of any kind in history, according to Elliptic, a consultancy specialising in crypto-related crime. The incident, which took place late on Thursday, is more than four times bigger than the previous largest crypto hack, the $1.5bn one targeting the Bybit exchange last year. Elliptic says there does not appear to be anything comparable in the pre-crypto era.
“This incident is almost certainly the single largest known theft of any kind,” says Tom Robinson, the consultancy’s chief scientist. “Before Bybit, that record was held by Saddam Hussein, who took $1bn from the central bank of Iraq in Baghdad on the eve of the 2003 Iraq war. The Binance theft is more than six times larger.”
So what exactly is cryptocurrency?
This digital asset operates online, outside the traditional financial system. There is no physical version of the most popular form of crypto – bitcoin – or its peers, such as Ethereum, Ripple and Dogecoin.
A cryptocurrency such as bitcoin runs on a combination of encryption, which is the sort of technology that keeps your WhatsApp messages safe, and peer-to-peer networks that allow computers to connect without a central server (think of the music-sharing sites like Napster at the turn of the century).
In short, the owner of a bitcoin (or part of a bitcoin; you can buy them in fractions) has access to a private key – like a long password – which is needed to access the funds. These transactions are all stored and displayed on a publicly available ledger, like a school register, known as a blockchain. You typically store your private keys in a “crypto wallet”.
There are varying estimates for how many cryptocurrencies there are but Coingecko, which monitors the market, claims there are more than 22,000 coins. The entire market is worth about $2.7tn, so it is not a surprise that hackers and rogue states looking for funds are interested in a corner of the global finance industry that has so much money, is largely unregulated and is vulnerable to digital thieves.
And what is a cryptoexchange?
A cryptoexchange is where you buy, sell and trade digital assets such as bitcoin. They host your crypto wallets, which are typically “cold”, meaning they are not connected online and can be kept safer from hackers. A smaller amount sits in “hot” wallets which are linked to the internet so they can be used for quick withdrawals, making them of greater interest to hackers. Binance is the world’s largest of these exchanges in terms of the number of trades it carries out every day – at a value of about $95bn daily.
How was Binance hacked?
It does not appear that private keys were hacked. Instead, a Binance engineer’s laptop was infiltrated, which in turn allowed the attackers to drain “hot” wallets. Binance later added that there were “additional points of breach” in its systems as well as the laptop.
“Hackers rarely crack the cryptographic keys themselves,” says Robinson. “They instead target people with access to those wallets. Binance says the attack involved a compromised engineer’s laptop, along with other points of breach. This gave the attacker a way into Binance’s internal systems. From there, they made Binance’s own systems sign transactions that sent the funds to the attacker.”
More than $2.5bn of the $6.3bn was taken in one transaction alone.
“Crypto exchanges are safer than they used to be, but not immune to attacks such as this,” says Robinson. “This hack shows that even the biggest exchange can be breached through one employee’s laptop. What matters most for customers is whether the exchange can cover the loss. Binance says it will repay everyone from its own funds.”
How do the hackers get hold of their haul?
They will have to “cash out” the crypto and turn it into legitimate money, known as fiat currency. Chainalysis, a crypto research firm, has said the attackers used “never seen before” laundering patterns to exfiltrate the affected assets. Phil Larratt, a senior director at the consultancy, says the thieves will now try to convert the crypto into fiat money in a process that “takes weeks and months, if not years”.
“The process is patient and sophisticated,” he says.
Laundering methods used by crypto hackers include visiting less scrupulous exchanges, using swapping services that exchange one type of crypto asset for another, and accessing brokers who will convert crypto to cash in exchange for a cut of the proceeds.
Do we know who did it?
This attack has been attributed to a North Korean hacking unit called TraderTraitor, a name assigned to it by the US government. The communist state, short of cash and hamstrung by sanctions, has a strong track record of crypto hacking. TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.
Last year TraderTraitor was blamed for the $1.5bn theft from the Dubai-based Bybit. Elliptic and two other crypto analysis firms have attributed the attack to North Korea. Elliptic said some of the funds taken from Binance have already been traced to wallet addresses used in a cryptoexchange hack last month that is also thought to have been carried out by operatives from the rogue state.
Rafe Pilling, the senior director of threat intelligence at the cybersecurity firm Sophos, says North Korea had previously hacked conventional financial targets such as the Bangladesh Central Bank and even cash machines.
But crypto delivers bigger potential rewards, he says. “Crypto is less well regulated, easier to move, easier to launder and that makes it a more enticing target for North Korea. And as a result you have groups like TraderTraitor that are specialising in attacking crypto firms and getting away with huge payments.”
Are my crypto investments safe?
Any guarantees will be coming from Binance itself, rather than any regulatory or government-backed safety nets. The exchange said in a post on X that it would “cover all losses” and “user funds are safe”. It also said it had frozen about half the funds targeted in the hack, stopping the thieves from making off with that tranche of cryptocurrency.
In Australia, you can claim a capital loss on your tax return if you can offer proof that a crypto asset was lost or stolen. However, most customers won’t have any legal protections.
Crypto users are not covered by formal deposit protections in countries such as the US, UK or Australia if things go wrong, including if an exchange is hacked or ever goes bankrupt.
Customers of regulated banks are guaranteed capped refunds – up to £120,000 per customer per bank in the UK, and $250,000 in the US – but only if the lender goes out of business. It will not pay out claims if there is a hack but the bank keeps operating.
