Binance, one of the world's largest cryptocurrency exchanges, has made headlines with a multi-billion dollar cyberattack. A group of hackers targeted the digital wallets the company uses to conduct transactions and seized approximately $6.3 billion worth of crypto assets.
Transactions reflected in blockchain records revealed that the majority of the heist was completed within approximately 20 minutes. Following the attack, Binance announced that losses would be covered, and action was taken to freeze a portion of the stolen assets.
Reuters addressed the details of the attack that shook the cryptocurrency world with four fundamental questions.
1. How was Binance's digital vault breached?
According to Binance's statements and examinations conducted by experts on blockchain records, approximately $6.3 billion worth of crypto assets were stolen from the digital wallets the exchange uses to execute its transactions.
In its initial statement on X, the company announced that they were evaluating the possibility that the attack originated from a compromised laptop. However, the subsequent investigation determined that the security breach involved other points as well.
In its statement, Binance said, “Our subsequent investigation revealed other points where security was compromised.”
According to an analysis by the US-based blockchain analytics firm TRM Labs, the attackers compromised the signing infrastructure Binance uses to approve transactions. This allowed them to issue transaction instructions that enabled the transfer of assets from the digital wallets.
Hong Kong-based lawyer Joshua Chu explained the mechanics of the attack with a simple example:
“Simply put, the attacker may not have stolen the key to the safe. Instead, they may have compromised the system that gives the instruction to release the money from the safe.”
Blockchain records show that the attack began shortly after 20:00 GMT on Thursday (23:00 Turkish time) and that the multi-billion dollar transfer was carried out in about 20 minutes.
The attackers attempted to move the seized assets to addresses that Binance's business partners and stablecoin issuers could not intervene with. However, with the intervention of these organizations, approximately half of the stolen assets were frozen.
According to information on Binance's website, the company operates a user asset protection fund containing $1 billion worth of Bitcoin reserves to protect its customers in the event of potential security breaches.
Binance Co-CEO Richard Teng announced that the losses resulting from the attack would be covered using this fund and the company's own capital.
2. Are North Korean hackers behind the attack?
The identity of the person or group behind the attack has not yet been definitively determined. However, many US-based blockchain analytics firms have pointed out that the attack shows similarities to operations previously attributed to North Korean hackers.
While Binance Co-CEO Richard Teng stated that the identities of the attackers have not yet been identified in the company's investigation, the North Korean government regularly denies accusations of cyberattacks and cryptocurrency theft.
TRM Labs announced that the Binance attack shares similar characteristics with the attack carried out against the cryptocurrency exchange Bybit last year. That attack was attributed to North Korean hackers by the US Federal Bureau of Investigation (FBI).
TRM Labs reported that it is highly confident that the same group is behind the Binance heist.
Blockchain analytics firm Chainalysis also announced that assets stolen in the attack on the cryptocurrency exchange Bitget last month were mixed with cryptocurrencies obtained from the Binance attack.
These developments have strengthened the possibility that there may be a connection between attacks targeting different cryptocurrency platforms.
3. Where is the stolen $6.3 billion now?
Following the attack, the most important question has been how much of the multi-billion dollar crypto assets can be recovered.
Approximately half of the stolen assets consist of stablecoins frozen by organizations including Tether, Circle, Ripple, and the Trump family's cryptocurrency venture, World Liberty Financial.
However, the freezing of assets does not mean they will be returned directly to Binance. This intervention primarily makes it difficult for the attackers to cash out the assets in question.
TRM Labs stated that a portion of the stolen assets was used as collateral to borrow Ethereum (ETH). According to the company's estimates, approximately $2.4 billion worth of Bitcoin and Ethereum are in wallets that freezing interventions cannot reach.
Patrick Tan, General Counsel at the Singapore-based blockchain intelligence firm ChainArgos, explained why it is not possible to freeze Bitcoin and Ethereum with these words:
“There is no company that mints Bitcoin or Ethereum. Therefore, no company can freeze these assets.”
According to market experts, attackers may resort to different methods to cover the tracks of the stolen cryptocurrencies. These include mixing the assets with other cryptocurrencies, converting them into lesser-known digital assets, or transferring them through smaller cryptocurrency exchanges.
Bernardo Brites, CEO of the stablecoin infrastructure company Trace Finance, pointed out that the attackers' room for maneuver is narrowing over time.
Brites stated that it is becoming increasingly difficult to transfer the stolen assets to other exchanges or payment service providers, noting that these assets have effectively been blacklisted.
Emphasizing that the first few hours are of critical importance in laundering proceeds from cryptocurrency attacks, Brites made the following assessment:
“In reality, a significant portion of the proceeds from such attacks can only be laundered within the first few hours. After this period, a large number of market participants learn that the assets in question have been flagged as stolen. As a result, these assets often sit for years without being moved.”
4. What awaits the cryptocurrency market after the Binance attack?
The attack on Binance has become the latest in a series of major security breaches in the digital asset sector recently.
According to TRM Labs data, a total of $2.9 billion worth of crypto assets were stolen in approximately 150 separate cyberattacks last year. The Binance case, with its $6.3 billion magnitude, has brought the sector's security problems back to the agenda.
Binance announced that all potential losses of users would be covered. However, this statement by the company was not enough to eliminate the loss of confidence the attack created in the cryptocurrency market.
Following the attack, there was a decline in cryptocurrency prices on Friday. A decrease was also observed in the total market value of stablecoins. This picture indicated that investors have begun to reduce their positions in digital assets and withdraw their money from the market.
Following the multi-billion dollar heist, eyes have turned to how much of the stolen assets can be recovered on one hand, and how the security infrastructure of one of the world's largest cryptocurrency exchanges could be breached on the other.
News Source: 12punto
