A notorious North Korean hacking unit may have compromised a single Binance employee’s laptop to pull off the record-breaking $6.3 billion hack of the cryptocurrency exchange – indicating a potential inside job or a stunning AI-powered infiltration of the company’s software.
uncertain
unit → compromise → software
Binance, the world’s largest crypto exchange, initially said the digital theft of the century may have centered on an engineer’s laptop, later adding that it identified “additional points of breach” – suggesting a complex attack carried out by more than one person.
uncertain
it → say → person
Ido Ben-Natan, CEO of Blockaid, which was the first party to identify Thursday’s attack, within just two minutes of the drain, said he wouldn’t rule out an inside job.
“In order to penetrate the network, phishing is one option or getting someone hired at Binance,” Ben-Natan told The Post.
asserted
Natan → identify → Post
However, he said North Korean hackers most likely leveraged artificial intelligence.
asserted
hackers → say → intelligence
AI models are increasingly able to detect crypto exchanges’ unknown software flaws – known as “zero-day vulnerabilities” — enabling hackers to carry out much larger heists.
asserted
models → detect → heists
Crypto hacks have been growing larger and more frequent, with roughly $1.2 billion stolen in 255 attacks from July to September – up from $822 million in 222 incidents from April to June, according to data from blockchain security firm CertiK.
TraderTraitor, the North Korean cybercrime group suspected of the record-breaking Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.
Crypto exchanges are easy targets for hacking groups like TraderTraitor, since digital assets can be transferred around the world much faster than any physical asset, and with a degree of anonymity – making them much more difficult to recover.
“They tried more than 50 times” to get into the exchange, Ben-Natan said.
uncertain
Natan → grow → exchange
Once inside, the hackers started draining crypto accounts, a process that took just 20 minutes, then scrambled to send the riches to different networks around the world, he said.
asserted
he → start → world
“This attack was done by North Korea, that’s clear,” Ben-Natan said.
asserted
Natan → do → Korea
“Any time there is a hacking like this, money starts being sent everywhere as quickly as possible.”
asserted
money → be → this
Richard Teng, co-CEO of Binance, said Friday that the hackers “also used a self-destruct mechanism … making it more difficult for us to trace and investigate.”
Hackers typically rely on social engineering, software hacks or some sort of combination.
In the first instance, attackers trick humans – like employees at the company – into giving them access to private systems by sending scam emails or messages.
asserted
attackers → say → emails
They might also steal employee credentials or passwords.
uncertain
They → steal → credentials
Idan Ofrat, co-founder of Fireblocks said it was likely that the hackers used “a phishing attempt like a LinkedIn message or email.
asserted
hackers → say → message
With the right security practices, all of this could have been prevented.”
uncertain
all → prevent → this
Hackers might also target weaknesses in an exchange’s blockchain to disable security controls.
uncertain
Hackers → target → controls
One example is when attackers steal cryptographic keys that authorize transactions, allowing them to move funds out of crypto wallets without the necessary passwords.
asserted
them → steal → passwords
After an attack, hackers rush to launder money to avoid losses from currency being frozen – one example is putting crypto into a decentralized lending market.
asserted
example → rush → market
Hackers can still take out loans based on the amount even if currencies are frozen.
asserted
currencies → take → amount
The crypto exchange added that it’s on track to allow customers to make withdrawals within two days and that it has set over $6 billion of company funds aside to cover customers’ losses.
asserted
it → add → losses
Blockchain transactions are permanently recorded, which allows officials to track stolen funds as they move between wallets and exchanges.
asserted
they → record → wallets
Centralized crypto exchanges and stablecoin providers have the ability to freeze assets on their platforms.
asserted
exchanges → have → platforms
But freezing assets is not the same as recovering them.
asserted
freezing → freeze → them
Since the industry is still largely unregulated, getting back stolen funds can be a long and tedious process, involving cooperation from crypto exchanges, token issuers and law enforcement.
asserted
getting → get → exchanges
Absent such cooperation, the digital moolah is gone for good.
asserted
moolah → go → cooperation
The Aporia
