Crypto exchange Binance is investigating the theft of approximately $6.3 billion from online wallets. According to the analytical company TRM Labs, the bulk of the funds were withdrawn in about 20 minutes on October 29, affecting assets in several blockchains. The exchange suspended deposits and withdrawals of money and said it would cover customer losses. By the time WIRED was published, market participants had managed to freeze about half of the stolen amount, primarily stablecoins. The remaining funds are being tracked, but the possibility of returning them depends on further transfers and cooperation between the sites.
Several companies studying the cryptocurrency movement suggest the attack is linked to the TraderTraitor group, which has previously been linked to North Korea. This is a working version, and not an established result of the investigation: neither Binance nor law enforcement officials have yet named the perpetrators. Researchers point to preparatory operations, test transfers and similarities between money routes and previous hacks. Binance first talked about a possible infection of an employee's laptop, then reported additional points of penetration. The full technical picture has not yet been published. The case is important not only because of the record amount. It shows how quickly an automated operation can empty hot wallets and why reserve funds, limiting authority, and pre-arranged withdrawal stops are critical for an exchange. Figures on blocked assets may change as the investigation progresses.