Cryptocurrency firms and investigators are racing to freeze and track down billions of dollars of stolen digital cash following what appears to be the largest crypto heist of all time. On Thursday, starting at around 4pm ET, hackers started quickly siphoning around $6.3 billion in cryptocurrencies, spread across multiple blockchains, from wallets belonging to crypto exchange Binance.
Following the theft, Binance almost immediately suspended all deposits and withdrawals from its services as part of its investigation into the hack and says it is working to identify who was behind the breach. The company, along with other crypto firms, says it has so far been able to freeze around half of the stolen funds—essentially stopping hackers moving the money further or trying to cash it out. Much of the remaining crypto may not be possible to freeze, however.
Three crypto tracing firms have been quick to link the attack potentially to North Korean hackers. “We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED. “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”
The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs. Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron and Solana—were drained and sent to multiple addresses controlled by a single attacker, according to TRM’s analysis. “Preparation began at least 36 hours before the theft,” TRM says in a blog post. The company says one of the attacker’s wallets received three small withdrawals during a test period, before later expanding the operations.
“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.” Hot wallets are cryptocurrency wallets that are internet connected and allow crypto exchanges to handle customer withdrawals. Analysts say the funds were drained from hot wallets across the impacted blockchains.
The tactics used in the hack appear to mimic previous methods used by an elite subset of North Korean hackers, known by the name TraderTraitor. Crypto tracing firms TRM Labs and Chainalysis both say they believe TraderTraitor may be behind the attack, while Robinson says Elliptic hasn’t specifically tied it to the group but sees overlaps in the activity.
Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers. Over recent years, North Korean hackers have repeatedly targeted cryptocurrency firms and stolen hundreds of millions in crypto heists. Multiple North Korean hacking groups can target companies in the sector, but TraderTraitor have become specialists, pulling off infrequent but high profile attacks.