$6.3 Billion Cleaned Out from Binance in Just 20 Minutes… Did They Fall Victim to North Korea's Lightning Speed Attack?

It took hackers, believed to be linked to North Korea, a mere 20 minutes to pull off a record-breaking $6.3 billion hack on the cryptocurrency exchange Binance.

According to Reuters and analytics firms TRM Labs and Chainalysis on October 30 (local time), the attackers are believed to have deployed automated systems to launch the offensive.

The attackers first hacked the laptops of Binance's development and operations engineers, securing signing authority that allowed them to bypass standard approval procedures.

Using this authority, they began extracting cryptocurrencies, including XRP, from 10 of Binance's blockchain wallets starting around 4:05 p.m. Eastern Time on October 29 (5:05 a.m. KST on October 30).

Between 4:05 and 4:09 p.m., they transferred 233.46 million XRP to their accounts, and around 4:10 p.m., they hijacked Solana and Optimism wallets.

At 4:20 p.m., they swept up 18,270 bitcoins, and two minutes later, they unauthorizedly withdrew 612.7 million Tether (USDT).

The hackers' use of algorithms to steal the cryptocurrency is interpreted as an effort to evade tracking networks while dodging cryptocurrency asset freezing measures.

In fact, immediately after stealing stablecoins and other assets vulnerable to freezes, they made a surprise exchange of about $325 million for 122,300 ethers.

At the time, the market price of a single ether was between $2,300 and $2,350, but the hackers exchanged them at $2,650 each, which is presumed to be aimed at urgently disposing of the stablecoins.

They also borrowed 19,760 ethers using $60 million worth of stablecoins as collateral.

Unlike stablecoins, which have fund-freezing functions, bitcoin and ethereum are decentralized coins that are difficult to control, meaning the tactic targeted the fact that technical freezing measures are practically difficult.

About 10 minutes later, they attempted to transfer the remaining $175 million worth of stablecoins to their criminal accounts, but the crypto industry initiated freezing measures faster at 5:14 p.m.

Immediately after the incident, stablecoin issuers Tether and Circle froze approximately $1.57 billion and $800 million worth respectively, and World Liberty Financial, co-founded by members of the Trump family, also stated that it froze $27 million (36 billion KRW).

However, this came after the hackers had already converted a significant portion into assets that cannot be frozen.

Despite such a "lightning speed" operation, the hackers showed caution and meticulousness in siphoning off the stolen funds.

When sending funds to specific wallets, they reportedly deposited small amounts first to verify that the wallets were operating normally before transferring the funds in earnest.

They also created a cyclical structure by repeatedly sending and circulating funds among multiple wallets to disrupt tracking networks.

However, circumstances arose during this process where the stolen funds from last month's Bitget hack and this Binance theft became mixed together, leaving evidence that they are an elite North Korean hacking organization known as "TraderTraitor."

Despite the astronomical hacking losses, Binance emphasized that there would be no user damages whatsoever.

Richard Teng, Co-Chief Executive Officer (CEO), announced via X (formerly Twitter), "Customer funds are never used, so there is no impact."

Founder Changpeng Zhao, who has stepped back from frontline management, also reassured customers, saying, "As a shareholder, I expect all user funds to be fully compensated," and "User funds are safe."

Binance plans to cover the losses by mobilizing its emergency fund, the Secure Asset Fund for Users (SAFU) worth $1 billion, $6.34 billion in company-held funds, and $1 billion in SpaceX shares held by founder Zhao.

Binance stated that it plans to resume cryptocurrency withdrawal services, which were temporarily suspended due to this incident, within approximately 34 hours.

The U.S. Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) also launched investigations immediately after the incident in cooperation with Binance and others.

British blockchain analytics firm Elliptic evaluated that this incident is the largest single-event scale on record.

(Photo: Getty Images)
※ Please note: This article was translated by AI and may contain errors.