Blockchain Firms Link North Korea to $6.3 Billion Binance Hack

Blockchain analysis firms Chainalysis and TRM Labs have linked the $6.3 billion Binance hack yesterday to TraderTraitor, a unit associated with North Korea. If confirmed at this scale, the theft would be the largest crypto hack on record. 

Chainalysis puts the total at $6.4 billion in its own assessment. Chainalysis says funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. Eastern Time on October 29. 

The firm said the attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. 

The attacker then swept assets into addresses under its control. Binance has said its initial investigation points to a compromised engineer’s laptop, which gave an attacker access to a service container and enabled unauthorized withdrawals. 

The exchange said it has found no evidence of a wallet private key leak.

The attacker reportedly tried to outpace freezes by converting stablecoins into ether and other assets that issuers cannot freeze. Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over roughly 20 minutes, then sent the remaining $175 million to stopover wallets. Freezes began by 5:14 p.m. Eastern, according to the firm.