A notorious North Korean hacking unit may have compromised a single Binance employee’s laptop to pull off the record-breaking $6.3 billion hack of the cryptocurrency exchange – indicating a potential inside job or a stunning AI-powered infiltration of the company’s software.
Binance, the world’s largest crypto exchange, initially said the digital theft of the century may have centered on an engineer’s laptop, later adding that it identified “additional points of breach” – suggesting a complex attack carried out by more than one person.
Ido Ben-Natan, CEO of Blockaid, which was the first party to identify Thursday’s attack, within just two minutes of the drain, said he wouldn’t rule out an inside job.
KCNA VIA KNS/AFP via Getty Images
“In order to penetrate the network, phishing is one option or getting someone hired at Binance,” Ben-Natan told The Post.
However, he said North Korean hackers most likely leveraged artificial intelligence. AI models are increasingly able to detect crypto exchanges’ unknown software flaws – known as “zero-day vulnerabilities” — enabling hackers to carry out much larger heists.
Crypto hacks have been growing larger and more frequent, with roughly $1.2 billion stolen in 255 attacks from July to September – up from $822 million in 222 incidents from April to June, according to data from blockchain security firm CertiK.
TraderTraitor, the North Korean cybercrime group suspected of the record-breaking Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.
Crypto exchanges are easy targets for hacking groups like TraderTraitor, since digital assets can be transferred around the world much faster than any physical asset, and with a degree of anonymity – making them much more difficult to recover.
“They tried more than 50 times” to get into the exchange, Ben-Natan said.
Once inside, the hackers started draining crypto accounts, a process that took just 20 minutes, then scrambled to send the riches to different networks around the world, he said.
“This attack was done by North Korea, that’s clear,” Ben-Natan said. “Any time there is a hacking like this, money starts being sent everywhere as quickly as possible.”
Richard Teng, co-CEO of Binance, said Friday that the hackers “also used a self-destruct mechanism … making it more difficult for us to trace and investigate.”
Hackers typically rely on social engineering, software hacks or some sort of combination.
In the first instance, attackers trick humans – like employees at the company – into giving them access to private systems by sending scam emails or messages. They might also steal employee credentials or passwords.
Idan Ofrat, co-founder of Fireblocks said it was likely that the hackers used “a phishing attempt like a LinkedIn message or email. With the right security practices, all of this could have been prevented.”
