Hackers steal $6.3 billion from Binance in biggest crypto heist ever

Hackers have stolen about $6.3 billion worth of digital assets from Binance, a major cryptocurrency exchange operator.

The heist is more than four times larger than the largest crypto theft to date. TRM Labs Inc., a venture capital-backed blockchain intelligence startup, believes that both cyberattacks were carried out by a state-backed North Korean hacking group called TraderTraitor.

About 40% of the stolen sum consisted of stablecoins issued by three major crypto companies: Circle Internet Group Inc., Ripple Labs Inc. and Tether Ltd. They managed to freeze most of the funds before the hackers put them out of reach. For its part, Binance has set aside over $6.34 billion to cover users’ losses.

The hackers stole the funds by manipulating several of the company’s wallets. One of them runs the infrastructure that Binance uses to process customers’ Ethereum transactions. According to TRM, the hackers broke into the wallet late Thursday and transferred the entire balance to a wallet they controlled.

TraderTraitor compromised Binance’s wallet by exploiting an Ethereum feature called EIP-7702 that the blockchain’s maintainers released last year. It allows a snippet of code, a so-called smart contract, to temporarily control a wallet. EIP-7702 only activates smart contracts if they receive approval for execution from the wallet operator. This authorization takes the form of an encrypted message.

The hackers used a malicious smart contract to take over Binance’s Ethereum wallet. It is currently unclear how they obtained the necessary permission to run such code.

According to Binance, an internal investigation revealed that TraderTraitor had compromised a laptop belonging to one of its DevOps engineers. The company says it has also “uncovered additional vulnerabilities.”

“Developer and DevOps machines are located near organizations’ most sensitive systems and have credentials, tokens and provisioning access,” said Kobi Sivilya, chief information security officer at cybersecurity firm Checkmarx Ltd. “For every organization, the question is how far an attacker can get from a single compromised workstation. Teams should consider who has constant access to which systems, whether that access is appropriately restricted, and whether a machine can access critical services without a secondary control.”

TRM found that TraderTraitor had been practicing the cyberattack for at least 36 hours before the theft. On Wednesday morning, the hackers deposited a small amount of money into a malicious crypto wallet. Early Thursday, they tested some of the code they used in the cyberattack on three different wallets.

According to Binance, the malware contained a “self-destruct mechanism” that deleted the tools the hackers installed in its infrastructure and the activity logs they created. The mechanism made it difficult for the company to investigate the attack. However, Binance discovered that the hackers bypassed the approval workflows it uses to process crypto outflows.

“Organizations that rely on exchanges, custodian banks or other key financial counterparties should ask themselves what ongoing visibility they have into these relationships,” Rand Davis, chief technology officer at SecurityScorecard, told SiliconANGLE in an email. “You should also ask yourself what your approach will be if an adversary pauses withdrawals or services. Security leaders can use this moment to identify which third parties are in their critical path, review contingency plans, and watch for phishing and social engineering consequences that typically follow a headline event of this magnitude.”

Binance has suspended crypto deposits and made crypto deposits on its exchange after discovering the breach. The company has since restored deposits, but its withdrawal processing system remains offline. Binance plans to reactivate the feature on Monday.

Photo: Unsplash