Binance Crypto Exchange Hacked for $6 Billion

If you are watching the crypto world, you are probably already aware of what happened. For the rest of you, this will catch you up.

Binance is a global cryptocurrency exchange that was compromised out of $6 billion. Interestingly, this was Binance’s money and not their customers’ wallets directly.

The FBI has attributed this to North Korea, meaning that even if we figure out who did this, the odds of arresting them is about as close to zero as you can get.

So what happened?

First of all, the entire attack only took about 20 minutes. This is an example of if you are not watching things in real time, your goose is cooked.

Binance says that their early assessment was that one of their engineer’s laptops was compromised, which allowed attacked to gain access to system components which allowed the hacker to submit unauthorized withdrawals. ONE ENGINEER. ONE LAPTOP.

After many attacks like this in the past, crypto companies now keep a reserve, which is like a self-insurance policy. They halted withdrawals for a couple of days but have resumed them now. That is the advantage of going big. They have the resources to deal with even something this big.

What is interesting is that they were able to “freeze” about $3 billion of the stolen money. How? Since this was their money, they weren’t speculating and the money, or at least about half of the $6 million was in dollar denominated tokens. These tokens have an issuer and as a result, Binance could ask the issuer to freeze those tokens. This means that while they go through the legal process to get them back, which could take years, the hackers don’t have them.

The rest of the money, and I use that term loosely, was in crypto that was not centrally managed and as a result there is no one to ask to freeze them.

HOWEVER, there is a big however. Even though privacy folks think crypto is private, it is anything but private.

There are now companies who track all of these transactions. Some are easy to follow (like Bitcoin) and others are hard to follow (like Eth). Still there is a trail of breadcrumbs. If you are willing to spend enough time and money, you can generally follow them. This is North Korea, so probably they are not going to try and “cash out” this stuff to gold, at least not right now. And, there are ways to make it hard, but probably not impossible, for these detectives to track it.

Probably, in the end, they will get some of their $6.3 billion back. How much and how long it will take is not clear. The good news for customers is that they say they will make everyone whole. Not because they have to but because, if they don’t, their reputation will be totally trashed and effectively, they will no longer be a big player.

From North Korea’s viewpoint, ONLY making $3 billion for a day’s work is ok. Even if it winds up to only be $2 billion, they will take it and be happy.

Credit: Security Week and Tech Crunch

by