// TOM'S HARDWARE US — HARDWARE & GADGET
Suspected North Korean hackers steal $5.6 billion in crypto in record-breaking cryptocurrency heist, Binance withdrawals frozen
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Update, Friday 30 Oct, 6:30 am ET: This developing story has been updated with information from Binance regarding how its system was compromised, and reports from security outlets claiming North Korea may be responsible. These details have been added to the story below.
From hereon, this month shall be called SpookITober. In yet another high-profile cybersecurity incident this month, Binance.com, the world's largest cryptocurrency exchange, has been hacked, to the tune of $5.6 billion taken in various cryptocurrencies. As of this writing, withdrawals at the exchange are suspended until the company sorts out the situation, though it has stated repeatedly that "user funds remain safe," adding that it "will cover all losses." The U.S.-specific Binance.us website is so far reportedly unaffected. At least two security agencies, including TRM, have pinned the attack on an elite North Korean hacking unit.
"Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach," the company said in an update on Friday. "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them."
"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit," the security firm said. "We base this assessment on robust on and off-chain intelligence sources," continuing to note that the group has been named responsible for a $1.5 billion Bybit hack last year. Per TRM, this latest instance bears many of the same hallmarks as earlier North Korean heists. According to CNN, an unnamed analyst at Pangolin Intelligence corroborated this story by "Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents [involving the North Korean cyber unit]."
Preliminary info breaks down the stolen amounts like so: $1.57b in Tether dollars (USDT), $1.45b in Bitcoin (BTC), $875m in Ethereum (ETH), $823m in Circle dollars (USDC), $234m in Tron (TRX), $88.5m in Ripple dollars (RLUSD), $75M in Wrapped-Beacon Ethereum (WBETH), $50m in Tether Gold (XAUT), and $447.5 million in other cryptocurrencies. The "dollar" currencies are all stablecoins, meaning they're pegged to $1 to represent dollars in the virtual space. Meanwhile, Tether Gold is pegged to the value of one troy ounce.
The stablecoin issuers all moved to blacklist the thief's main wallet (you can see it here on the Ethereum blockchain) in their smart contracts, a move that means the amounts in USDT, USDC, and RLUSD are frozen in place, totaling around $2.4 billion. It's possible, but not guaranteed, that the gold-pegged XAUT will also be frozen.
Note that this does not mean those funds have been recovered — the thief simply cannot do anything with those tokens, be it moving or exchanging. Normally in these situations, restitution from the frozen funds happens only after complainants provide proof of ownership, something that usually means copious time spent in courts.
The situation is a lot more grim for the amounts in pure cryptocurrencies like Bitcoin and Ethereum, among others. Since there is no governing entity for their blockchains, the most likely prospect is that the remaining $3.2 billion or so is forever lost in the ether — though some networks incorporate clawback mechanisms. Exchanges may block the thief when he eventually tries to cash out his virtual dough, but historically this hasn't been a reliable means of recovery.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.