Just 20 Minutes to Wipe Out 8.4 Trillion Won in Crypto: Did Binance Fall Victim to North Korea's Lightning Speed Attack?

It took hackers, believed to be linked to North Korea, a mere 20 minutes to pull off a record-breaking USD 6.3 billion cryptocurrency hack at the crypto exchange Binance.

According to Reuters and analysis firms TRM Labs and Chainalysis on October 30 (local time), the attackers are believed to have deployed automated systems to carry out the assault.

The attackers first hacked the laptops of Binance development and operations engineers, securing signing privileges that allowed them to bypass standard approval procedures.

Using these privileges, they began siphoning off cryptocurrencies, including Ripple (XRP), from 10 of Binance's blockchain wallets starting around 4:05 p.m. on October 29, Eastern Time (5:05 a.m. on October 30, Korean Time).

Between 4:05 and 4:09 p.m., they transferred 233.46 million XRP to their accounts, and then seized Solana and Optimism wallets at around 4:10 p.m.

At 4:20 p.m., they swept up 18,270 bitcoins, followed just two minutes later by the unauthorized withdrawal of 612.7 million Tether (USDT).

The hackers' use of algorithms to steal cryptocurrencies is interpreted as an effort to scramble tracking networks while evading cryptocurrency asset freezing measures.

In fact, immediately after stealing stablecoins and other assets at risk of being frozen, they stealthily exchanged approximately USD 325 million worth for 122,300 ethers.

At the time, the market price of a single ether was USD 2,300 to USD 2,350, but the hackers paid USD 2,650 per coin in an exchange believed aimed at urgently disposing of stablecoins.

They also took out a loan of 19,760 ethers using USD 60 million worth of stablecoins as collateral.

Unlike stablecoins, which feature asset-freezing capabilities, Bitcoin and Ether are decentralized coins that are difficult to control, meaning the tactic targeted the technical reality that freezing them is virtually impossible.

About 10 minutes later, they attempted to transfer another USD 175 million worth of stablecoins to their criminal accounts, but the virtual asset industry initiated freezing measures even faster at 5:14 p.m.

Immediately following the incident, stablecoin issuers Tether and Circle froze USD 1.57 billion and USD 800 million worth, respectively, while World Liberty Financial, co-founded by members of the Trump family, announced it had frozen USD 27 million (36 billion won).

However, this came after the hackers had already swapped substantial amounts into unfreezable assets.

Even amid such a "lightning-fast operation," the hackers showed caution and meticulousness in moving out the stolen funds.

When sending funds to specific wallets, they reportedly deposited small amounts first to verify that the wallets were operating normally before transferring the funds in earnest.

They also scrambled tracking networks by creating a circular structure that repeatedly passed funds back and forth among multiple wallets.

However, in the process, circumstances emerged where funds from last month's Bitget hack and the funds stolen in this Binance incident became intermingled, leaving evidence that they are the elite North Korean hacking organization known as "TraderTraitor."

Despite the astronomical hacking losses, Binance emphasized that users would suffer zero losses.

Richard Teng, Co-Chief Executive Officer (CEO), announced via X (formerly Twitter) that "customer funds are never used, so there is no impact."

Founder Changpeng Zhao, who has stepped back from frontline management, also reassured customers, stating, "As a shareholder, I expect all user funds to be fully compensated," and adding, "User funds are safe."

Binance plans to cover the losses by mobilizing its USD 1 billion Secure Asset Fund for Users (SAFU) emergency fund, USD 6.34 billion in company-held funds, and USD 1 billion of SpaceX stock held by founder Zhao.

Binance stated that it plans to resume cryptocurrency withdrawal services, which were temporarily suspended due to this incident, within approximately 34 hours.

The U.S. Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) also launched investigations immediately after the incident in cooperation with Binance and others.

British blockchain analysis firm Elliptic evaluated that this incident is the largest single-event scale on record.

(Photo: Getty Images)
※ Please note: This article was translated by AI and may contain errors.