'Employee laptop compromised; no evidence of private key leak'

About $3 billion in assets frozen amid $6.3 billion estimated losses

South Korean won-based exchanges issue withdrawal caution notices

[Reuters]
[Reuters]

An estimated $6.3 billion was stolen from Binance, the world's largest digital asset exchange, in a hack that a blockchain analytics firm has attributed to a North Korean hacking group. Binance said the breach may have originated from a compromised employee laptop.

In an official notice Friday, Binance said initial findings suggest the incident may have begun when a DevOps engineer's laptop was compromised, allowing the attacker to access service containers and execute unauthorized withdrawal transactions. "No evidence has been found to date that wallet private keys were leaked," the exchange added.

DevOps — short for Development and Operations — refers to the practice of managing software systems from development through deployment and ongoing operation. DevOps engineers hold access credentials to the various services needed to run an exchange's withdrawal wallets. In this case, investigators believe the attacker obtained the internal access information needed to reach those services by hacking the laptop of the employee responsible for such work, then used that access to carry out unauthorized withdrawals.

Binance put its own estimate of losses at approximately $6.3 billion. The exchange said it has frozen about $3 billion in assets so far and plans to cover all losses in full using its Secure Asset Fund for Users (SAFU) and company funds. Binance said it is working to strengthen withdrawal service security and that suspended withdrawals are expected to resume within 48 hours.

Amid the fallout, industry analysts pointed to North Korea as the likely culprit. Blockchain analytics firm TRM Labs said in a report released the same day that the attacker drained approximately $6.36 billion in assets from Binance wallets across 10 blockchains on Thursday (local time), attributing the attack to TraderTraitor, an elite North Korean hacking group.

TRM Labs said the attack bore hallmarks of past North Korea-linked hacks, including the attacker's use of pre-obtained transaction signatures to move funds rapidly and the use of Tornado Cash to obscure the money trail. TraderTraitor was also identified as the group behind the Bybit hack in February last year, which resulted in losses of approximately $1.5 billion.

The report also found that EIP-7702, an Ethereum feature that allows accounts to delegate authority, was exploited in the attack. EIP-7702 enables standard wallets to delegate specific functions to smart contracts. TRM Labs said the attacker used this feature to link a malicious smart contract to Binance's hot wallets, repeatedly siphoning newly deposited assets as they arrived.

South Korean exchanges also issued caution notices Friday, urging users to exercise care when withdrawing digital assets to Binance. Upbit said it had confirmed signs of a security incident and the theft of some digital assets at Binance, adding that it is continuously monitoring the situation and may restrict withdrawals to Binance if necessary to protect investors.

Bithumb similarly said it had identified circumstances suggesting a security problem at Binance, and that it is monitoring market conditions and may limit withdrawals to Binance as needed to protect user assets.


kyoung@heraldcorp.com