Massive Cryptocurrency Heist Shakes the Industry
In a startling turn of events, cryptocurrency companies and investigators are racing against time to freeze and trace billions of dollars in stolen digital assets following what appears to be the largest cryptocurrency theft in history. On Thursday, at approximately 4:00 PM (EST), hackers swiftly siphoned off around $6.3 billion in cryptocurrencies from wallets belonging to the cryptocurrency exchange platform Binance, across various blockchain networks.
In response to this unprecedented breach, Binance promptly suspended all deposits and withdrawals as part of its investigation into the attack. The exchange has stated that it is actively working to identify the perpetrators behind this security lapse. Collaborating with other firms in the cryptocurrency sector, Binance claims to have successfully frozen roughly half of the stolen funds, effectively preventing the hackers from moving or cashing out the assets. However, a significant portion of the remaining cryptocurrency may prove difficult to freeze.
Expert Insights on the Attack’s Origins
Three cryptocurrency tracking firms have quickly linked the attack to potential North Korean hackers. Tom Robinson, Chief Scientist and co-founder of Elliptic, expressed concerns, stating, “We believe it is likely that North Korea is behind this. If they are indeed responsible, this single heist could nearly double the total amount the regime has stolen in cryptocurrencies to date.”
According to analysis by TRM Labs, the majority of the stolen cryptocurrencies were taken within a mere 20-minute window. Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron, and Solana—were emptied, with the assets redirected to multiple addresses controlled by a single attacker. TRM’s blog revealed that preparations for the attack began at least 36 hours prior to the theft. One of the attacker’s wallets received three small withdrawals during a testing phase before scaling up operations.
“Early on October 29, the operator deployed an initial piece of attack code and tested it on two wallets,” TRM explained. “Later that same day, they trialed the final version on a third wallet and subsequently diverted the test funds to their own account. Four hours after this trial run, the same code was installed in a Binance ‘hot’ wallet.” Hot wallets are cryptocurrency wallets connected to the internet, enabling exchanges to manage customer fund withdrawals. Analysts noted that the funds were taken from hot wallets across all affected blockchains.
North Korean Hackers Under Scrutiny
The tactics employed during the attack appear to mirror those previously used by a sophisticated subgroup of North Korean hackers known as TraderTraitor. Both TRM Labs and Chainalysis suspect that TraderTraitor could be behind this incident, although Robinson from Elliptic has not explicitly linked the group to the attack but acknowledges notable similarities in their activities.
Neither Binance nor law enforcement has indicated any suspicious connections between the attack and North Korean hackers. In recent years, North Korean hackers have repeatedly targeted cryptocurrency firms, amassing hundreds of millions through various breaches. While multiple hacking groups may go after cryptocurrency companies, TraderTraitor is known for executing infrequent but high-stakes thefts.
Within North Korea’s extensive hacking operations—often aimed at generating revenue for a regime under heavy sanctions—TraderTraitor has distinguished itself in recent years through its sophistication and focus on cryptocurrency and decentralised finance companies. Last year, the FBI accused TraderTraitor of being responsible for a $1.5 billion attack on the cryptocurrency exchange Bybit.
Binance’s Response and Future Implications
Binance has not responded to inquiries regarding whether it suspects North Korean hackers are behind the colossal theft, instead referring to a statement promising to cover all losses incurred from the attack and affirming their collaboration with law enforcement to identify those involved.
In a statement, the company noted, “Our initial investigation suggested that the security incident could have been linked to a compromised laptop; however, further investigation has revealed other points of breach. This was a complex attack, and we are doing everything possible, in coordination with law enforcement, to resolve it.”
Concerns Over Future Transactions and Recovery
“These individuals are, in a sense, artists when it comes to infiltrating these decentralised finance organisations,” explained Rafe Pilling, Senior Director of Threat Intelligence at security firm Sophos. “TraderTraitor seems to focus on these large-scale operations. In the past, they have developed their own fake applications and attempted to use them to infiltrate organisations.”
TRM and Chainalysis have initially linked the attack to TraderTraitor, asserting that their conclusions stem from analysing both on-chain and off-chain activities. “The most compelling evidence emerged when Chainalysis researchers observed in real time that the funds stolen from Binance were being mixed with funds taken in last month’s Bitget attack, which had been attributed to North Korean actors,” a Chainalysis research blog stated.
“Binance highlights that the attack began with a compromised laptop belonging to an engineer. Targeting personnel at cryptocurrency firms is a hallmark of TraderTraitor,” Robinson from Elliptic pointed out. “The attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, mirroring their approach with Bybit.”
While approximately $3 billion in cryptocurrencies were frozen following the attack, it is likely that the culprits could still make off with substantial sums, as not all stolen cryptocurrencies can be frozen. According to a Chainalysis study, the firm is observing “money laundering patterns we have not seen before,” and the rapid processing of thousands of transactions suggests that the hackers are employing “automation to cover their tracks.”
Robinson from Elliptic noted that, to date, cryptocurrency firms and exchanges have managed to freeze around $2.8 billion (approximately 44% of the total amount stolen), with nearly all of this involving stablecoins. “The remaining $3.3 billion primarily consists of Bitcoin, Ether, and XRP, which cannot be frozen,” Robinson explained. “They can only be halted when they reach an exchange or other service. Some will be intercepted in the coming months, but I do not expect the frozen proportion to increase significantly.”