Binance hit by ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis link it to North Korea's TraderTraitor
About $6.3 billion in cryptocurrency was stolen from Binance, which would make it the largest crypto heist on record. Binance's initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals, though a later update said additional breaches went beyond the laptop. TRM Labs and Chainalysis attribute the attack, with high confidence and likely respectively, to the North Korean group TraderTraitor. Binance says it will cover all losses from the SAFU fund and company funds, and user funds are safe.
Detalhes técnicos
- Binance found no evidence of a wallet private key leak. It is tracing the attack path through the compromised laptop and has said the attacker did not simply use one engineer's permissions.
- TRM counts about $6.36B leaving Binance wallets across ten blockchains. Wallets with different key types and signing schemes all produced valid signatures within about 30 minutes, which TRM says indicates a compromise of Binance's hot wallet signing infrastructure.
- On Ethereum, attackers took control of a hot wallet using 50 pre-signed authorizations, and TRM's early indicators suggested they had been phished. Phishing would not explain the activity on the other chains.
- Tether froze more than 1.567B USDT and Circle froze more than 800M USDC. Freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council reached about $2.7B, and Binance cites close to $3B frozen on-chain.
- Attackers still hold more than 420,000 ETH and 18,270 BTC (about $2.4B). TRM expects them to move through cross-chain bridges, swap services and OTC brokers.
Remediação
- Binance revoked the affected address authorization and is revamping the withdrawal service and its related addresses. Withdrawals are expected to resume within 48 hours, and an updated Proof of Reserves and a technical post-mortem are promised.
- TRM advises exchanges to screen deposits against the addresses it has tied to the theft.
Linha do tempo
-
Binance hit by ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis link it to North Korea's TraderTraitor
ler a análise desta fonte ocultar
About $6.3 billion in cryptocurrency was stolen from Binance, which would make it the largest crypto heist on record. Binance's initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals, though a later update said additional breaches went beyond the laptop. TRM Labs and Chainalysis attribute the attack, with high confidence and likely respectively, to the North Korean group TraderTraitor. Binance says it will cover all losses from the SAFU fund and company funds, and user funds are safe.
Technical Details
- Binance found no evidence of a wallet private key leak. It is tracing the attack path through the compromised laptop and has said the attacker did not simply use one engineer's permissions.
- TRM counts about $6.36B leaving Binance wallets across ten blockchains. Wallets with different key types and signing schemes all produced valid signatures within about 30 minutes, which TRM says indicates a compromise of Binance's hot wallet signing infrastructure.
- On Ethereum, attackers took control of a hot wallet using 50 pre-signed authorizations, and TRM's early indicators suggested they had been phished. Phishing would not explain the activity on the other chains.
- Tether froze more than 1.567B USDT and Circle froze more than 800M USDC. Freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council reached about $2.7B, and Binance cites close to $3B frozen on-chain.
- Attackers still hold more than 420,000 ETH and 18,270 BTC (about $2.4B). TRM expects them to move through cross-chain bridges, swap services and OTC brokers.
Remediation
- Binance revoked the affected address authorization and is revamping the withdrawal service and its related addresses. Withdrawals are expected to resume within 48 hours, and an updated Proof of Reserves and a technical post-mortem are promised.
- TRM advises exchanges to screen deposits against the addresses it has tied to the theft.