What happened at Binance from the beginning until now?
It started on the evening of Thursday, October 29, when large, suspicious transfers appeared from Binance wallets. The platform announced that it was investigating a security incident and halted withdrawals on several networks as a precaution. According to tracking by TRM Labs, most of the transfers took place over about 20 minutes and involved wallets across 10 networks.
As the investigation progressed, Binance announced that the affected assets were estimated to be worth around $6.3 billion and that, working with its partners, it had managed to freeze around $3 billion on the blockchain. But it’s important to distinguish between freezing funds and actually recovering them, because these figures are not an announcement of the final net loss.
So, how did the breach happen?
Binance’s initial investigation points to the possibility that an operations engineer’s laptop was compromised and used to access an internal service and send unauthorized withdrawal requests. The platform said that, so far, it had found no evidence that wallets’ private keys had been leaked. But this is only an initial explanation, and the final technical report has not yet been released.
Richard Teng later clarified that the attack was more complex than simply using one employee’s credentials or carrying out a single click, and confirmed that the investigation had not yet attributed responsibility to any individual.
As for who carried out the attack, TRM Labs attributed it, with a high degree of confidence, to the TraderTraitor group, which is linked to North Korea. This is the assessment of a blockchain analytics and investigations firm.
It started on the evening of Thursday, October 29, when large, suspicious transfers appeared from Binance wallets. The platform announced that it was investigating a security incident and halted withdrawals on several networks as a precaution. According to tracking by TRM Labs, most of the transfers took place over about 20 minutes and involved wallets across 10 networks.
As the investigation progressed, Binance announced that the affected assets were estimated to be worth around $6.3 billion and that, working with its partners, it had managed to freeze around $3 billion on the blockchain. But it’s important to distinguish between freezing funds and actually recovering them, because these figures are not an announcement of the final net loss.
So, how did the breach happen?
Binance’s initial investigation points to the possibility that an operations engineer’s laptop was compromised and used to access an internal service and send unauthorized withdrawal requests. The platform said that, so far, it had found no evidence that wallets’ private keys had been leaked. But this is only an initial explanation, and the final technical report has not yet been released.
Richard Teng later clarified that the attack was more complex than simply using one employee’s credentials or carrying out a single click, and confirmed that the investigation had not yet attributed responsibility to any individual.
As for who carried out the attack, TRM Labs attributed it, with a high degree of confidence, to the TraderTraitor group, which is linked to North Korea. This is the assessment of a blockchain analytics and investigations firm.
