What we know about the $6.3bn Binance hack

Binance has been hit by a record $6.3bn heist, raising questions over how systems at the world’s biggest crypto currency exchange were breached.

How did the hack happen?

The biggest hack in history appears to have begun via the laptop of one of Binance’s development and operations engineers.

The company said the device was compromised by hackers who used it to “submit unauthorised withdrawal transactions” and then drained a record $6.3bn from the crypto wallets of Binance’s customers.

Instead of accessing the private keys of users’ wallets, which is more typical in crypto hacks, the hackers exploited a laptop that already had access to the underlying systems for approving transactions.

“Binance’s engineers manage the systems that run the exchange,” Tom Robinson, co-founder of analytics company Elliptic, told the FT. “A DevOps engineer’s laptop typically holds the access needed to log into those systems. An attacker who controls that laptop can use the same access.”

“They got Binance’s own systems to send the money for them,” he added.

Hackers appear to have breached Binance wallets that were held on various blockchains including Solana, Ethereum, Coinbase’s blockchain Base and Tron, sending billions of dollars’ worth of crypto tokens to wallets that the hackers themselves controlled.

The theft began at 8.05pm GMT on Thursday and lasted for half an hour, with a second wave of withdrawals taking place after 11pm, Elliptic said.

Binance said it had “uncovered additional points of breach”, beyond the one laptop, but is still investigating precisely how the attack unfolded.

“There should be controls around how withdrawals are initiated, the addresses they’re allowed to send them to, controls around how those are approved . . . all of that failed,” said Alistair Heggie, chief executive of DA Insured, a crypto insurance company.

Who is behind the hack?

A North Korean unit known as TraderTraitor has been linked to the attack by blockchain intelligence company TRM Labs.

The secretive, cash-strapped state, which is cut off by sanctions, has gained a reputation for cyber hacking. Last year alone, North Korean hackers stole about $2bn, more than half of the global total, according to blockchain analytics company Chainalysis.

How much was taken?

About $6.3bn in almost 200 different cryptocurrencies was stolen.

Elliptic said that four tokens made up 74 per cent of the stolen funds — bitcoin, Circle’s USDC and Tether’s USDT stablecoins held on the Tron blockchain and USDT held on the Ethereum blockchain.

The analytics company said it had verified that $2.8bn of USDC and USDT had been frozen by Circle and Tether, but hackers had converted about $3.3bn of the stolen funds into digital assets that cannot be frozen, such as ETH.

It said the thieves were still working to move and convert them before eventually cashing out.

Can frozen assets be recovered?

Frozen assets can sometimes be recovered, although this requires crypto companies to work with law enforcement officials. Stablecoin companies Tether and Circle have the technology to destroy frozen assets and reissue the cryptocurrency directly to victims, although this takes time.

Stablecoin operators “usually do that only after a request from law enforcement or a court order, which can take weeks or months”, said Robinson.

Can Binance reimburse the losses?

Binance says all users facing losses will be repaid through a combination of its emergency reserve fund and from the company itself. The fund holds $1.2bn worth of bitcoin, according to its wallet.

On Friday, the exchange said it had “already reserved over $6.34bn of company funds to cover this incident”, $5bn of which was held “in the exact token assets that were impacted”.

It said it was buying cryptocurrency on the open market to make up the shortfall.

However, it admitted this could take longer because some tokens were infrequently traded. “Our company’s revenue for the year is sufficient to cover the losses,” Binance co-chief executive Yi He said on X on Friday, adding that the emergency fund “and Binance’s holdings include a large amount of assets such as bitcoin and ETH”.

Binance does not publish its financial accounts, making it very hard to verify claims about its revenues.

Who has been affected?

Binance is the world’s biggest crypto exchange and says it has more than 300mn registered users. Individual crypto traders are likely to be widely affected, as well as large institutions that use Binance because of its deep liquidity.

There are early signs of the wider impact on crypto companies. Lending platform Jupiter Earn said on Friday that it was facing a “liquidity crunch impacting withdrawals”.

The funds were taken from so-called “hot wallets”, where crypto from many users is pooled such that it is readily available for transactions, so the number of people affected is likely to be large.

Some of its biggest users had forced the exchange to allow them to hold their assets off the exchange, the FT previously reported, but many others still hold their assets directly on Binance wallets on the exchange.

Binance is regulated in Abu Dhabi. The emirate’s Financial Services Regulatory Authority said on Friday that it was “engaging closely with Binance and monitoring the incident”, adding that “protecting the interests of clients and supporting the integrity and orderly functioning of markets” was a key priority.

Additional reporting by Martin Arnold