The $6.3B Binance heist – is your crypto safe on exchanges? - USA Today
Twenty minutes is all it took to pull off the biggest cryptocurrency heist in history.
About $6.3 billion worth of cryptocurrencies was quickly swiped Oct. 29 from wallets that crypto exchange Binance holds and uses to process transactions, the exchange and blockchain analysis firms said. Binance said it froze all withdrawals and about $3 billion worth of crypto on the public blockchain to investigate what happened.
The hack shows that even the world's largest crypto exchange can be exposed to theft, and consumers need to be aware and vigilant about how they store their crypto, analysts said.
"An exchange account isn't a bank account," said David Gokhshtein, who covers crypto daily as founder of Gokhshtein Media. "Keep what you trade on an exchange and what you hold long term in your own wallet. That's the lesson."
Initially, Binance thought the heist involved a compromised laptop, but further investigation uncovered multiple points of breach, it said on X. Hackers used Binance's "signing infrastructure," which authorizes transactions and issues instructions, that emptied the wallets housing customer deposits the exchange uses for transactions, said U.S. blockchain analytics firm TRMLabs in a blog.
The attack was well planned, with smaller rehearsal thefts in the 36 hours leading up to the Binance heist, TRM said. It attributes the attack to TraderTraitor, North Korea’s premier hacking unit.
"We base this assessment on robust on and off-chain intelligence sources," TRM wrote. "Several features of this attack match earlier North Korea-linked heists," including small withdrawals funding an operator wallet, staging that began well before the theft and signatures obtained in advance then executed in one burst.
Though $6.3 billion moved out of Binance, issuers quickly reacted and within an hour or so froze all but $60 million of the digital assets so they couldn't be deposited, cashed out or spent.
Still, thieves managed to move fast and swap $60 million of stolen Tether stablecoin to Ether on Aave, a decentralized platform that lets users pool crypto to lend, borrow and earn interest, said Iman Shafiei, founder of educational platform and research firm Keystone Research Group. TRM said this type of swap to launder the crypto was different from earlier crypto thefts.
The bulk of the stolen crypto remains frozen and, likely recoverable, but could take decades, Shafiei warned. "They can’t unfreeze the crypto without proper court orders, and that could take years," he said.
In the Mt. Gox bitcoin exchange case, one of the earliest crypto hacks, distributions didn't even begin for a decade and remain ongoing, Shafiei noted. "Distributions are done in batches," he said.
Meanwhile, Aave users whose Ether were loaned to the hackers "had no idea (the Tether assets) was stolen until Tether, the company that issues the stablecoin of the same name blacklisted it," Shafiei said. "So those people holding onto the stolen funds are out" of their crypto. At some point, Aave users will have to be compensated, too, he said. Aave has a built-in insurance pool it set up that it can tap for these types of situations, he said.
Crypto, unlike cash deposits in banks, are not federally insured.
With technology and artficial intelligence (AI) gaining prominence, analysts expect more and even bigger attacks in the future.
"A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward, senior vice president international at cyber security firm Absolute Security. "Cyber threats are becoming more sophisticated and widespread as ever, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines."
With that in mind, financial institutions need to focus on ensuring each hack doesn't result in massive losses, analysts said.
“This demands a fundamental change in thinking," said Phoebe Hodgson, banking and payments senior analyst at GlobalData research firm. "The next generation of cyber resilience will be defined not by whether institutions can prevent every breach, but by whether they can stop attackers from turning that breach into irreversible financial loss.”
The best protection for digital assets is to keep them to yourself and not store them on any centralized exchange such as Binance, crypto experts said.
"Exchanges are for buying or selling, not storing," Shafiei said. "Exchanges are the biggest honeypot because (thieves) can access billions through one log in."
Instead, consumers should store their crypto in their own wallets, he said. There are two ways to do that:
Consumers can also use both. Shafiei said he uses the hardware wallet to hold assets like he would a bank account. It's more secure because of its on and offline feature, and he keeps that in a safety deposit box. He uses the wallet like a cash wallet he would carry around everyday, with only about $100 in it.
Medora Lee is a money, markets and personal finance reporter at USA TODAY. You can reach her at mjlee@usatoday.com and subscribe to our free Daily Money newsletter for personal finance tips and business news every Monday through Friday morning.
