$BNB $BTC
Who was behind the Binance hack? Three blockchain analytics firms point in the same direction: the North Korean hacking group TraderTraitor, a branch of Lazarus. But this is still the analytics firms’ assessment, not an official conclusion.
【What the analytics firms say】
· TRM: Attributes the attack to TraderTraitor, saying it is “highly confident”
· Chainalysis: Assesses that TraderTraitor was responsible, and says it observed an unprecedented automated money-laundering technique, with thousands of transactions in a short time and funds repeatedly circling between addresses
· Elliptic: Attributes the case to North Korea, saying the methods are consistent with TraderTraitor
Reported losses: Binance’s official figure is about $6.3 billion; Elliptic estimates about $6.43 billion, Chainalysis about $6.4 billion, and TRM about $6.36 billion.
【Evidence】
· The same laundering address: According to Elliptic’s verification, some of the stolen funds were split over about 28 hops on Tron, then moved cross-chain to Ethereum and landed in an address that had also received funds stolen from Bitget last month. Analytics firms had previously assessed the Bitget case as linked to North Korea
· Seed funds: The hackers’ wallet was funded by three small withdrawals from the mixer Tornado Cash. The attack code was tested and rehearsed in advance, then pre-signed transactions were sent in a concentrated burst—a pattern also seen in the Bybit and KelpDAO cases
· Scale: Elliptic estimates that funds were drained from 11 chains simultaneously in about 3 hours. Each chain has a different signing system, and very few teams could pull this off
· Targeting people: Binance says the attack may have started with the compromise of an operations engineer’s computer. Elliptic notes that the Bybit case also began with a breach of a developer’s computer
【Questions】
· Limited overlap: According to Elliptic, only about $39,000 of the stolen Binance funds have so far flowed into the shared address. The attackers may simply have used the same laundering network; this does not prove they were the same group
· The speed is unlike North Korean groups: North Korean groups usually convert stablecoins within minutes. This time, however, more than $2.6 billion in stablecoins could not be converted in time and was frozen by the issuers
· Different methods: This time, large amounts went through market makers and lending protocols, unlike the Bybit case, which relied mainly on cross-chain bridges for laundering
· Key facts are missing: Binance has not disclosed how that computer was initially compromised
【Official statements】
· The government and law enforcement agencies have not publicly attributed the attack to anyone. The Bybit case received an official attribution within five days, but this one has not. Separately, sources familiar with the matter say that the FBI and other agencies are working with Binance
· Binance has not named any group, saying only that it is working with law enforcement to confirm the attackers’ identity. An update at 16:47 said that further investigation had uncovered other possible points of entry, that the attack was relatively complex, and that a detailed postmortem would be published later. Binance had previously said it had found no evidence that wallet private keys were leaked
· Frozen funds: Elliptic verified about $2.84 billion; Binance’s figure is about $3 billion
· Reimbursement: At 18:55, Binance said it had prepared more than $6.34 billion in company funds, of which more than $5 billion was already in the corresponding stolen assets. The rest was being purchased on and off the market, and replenishment had begun
· Withdrawals: Still proceeding as planned; at 16:47, Binance expected them to resume within 45 hours. Deposits are unaffected
【Market snapshot】
At 20:15 Shanghai time, Binance spot BNB was at $701.3, down 5.3% over 24 hours, with a low of $680; BTC was at $77,459, down 3.2%.
Takeaway: Who was behind the attack does not change the reimbursement outcome. Binance has prepared enough funds and started replenishing them. For BNB, the key question is whether withdrawals resume on schedule. In the short term, it is fluctuating above $680; don’t chase a short.
Which do you think is more likely: North Korean hackers carried out the attack themselves, or they simply used the same laundering network?
Disclaimer: This analysis is for reference only and does not constitute investment advice!
#BNB #币安被盗 #BinanceOracle
Who was behind the Binance hack? Three blockchain analytics firms point in the same direction: the North Korean hacking group TraderTraitor, a branch of Lazarus. But this is still the analytics firms’ assessment, not an official conclusion.
【What the analytics firms say】
· TRM: Attributes the attack to TraderTraitor, saying it is “highly confident”
· Chainalysis: Assesses that TraderTraitor was responsible, and says it observed an unprecedented automated money-laundering technique, with thousands of transactions in a short time and funds repeatedly circling between addresses
· Elliptic: Attributes the case to North Korea, saying the methods are consistent with TraderTraitor
Reported losses: Binance’s official figure is about $6.3 billion; Elliptic estimates about $6.43 billion, Chainalysis about $6.4 billion, and TRM about $6.36 billion.
【Evidence】
· The same laundering address: According to Elliptic’s verification, some of the stolen funds were split over about 28 hops on Tron, then moved cross-chain to Ethereum and landed in an address that had also received funds stolen from Bitget last month. Analytics firms had previously assessed the Bitget case as linked to North Korea
· Seed funds: The hackers’ wallet was funded by three small withdrawals from the mixer Tornado Cash. The attack code was tested and rehearsed in advance, then pre-signed transactions were sent in a concentrated burst—a pattern also seen in the Bybit and KelpDAO cases
· Scale: Elliptic estimates that funds were drained from 11 chains simultaneously in about 3 hours. Each chain has a different signing system, and very few teams could pull this off
· Targeting people: Binance says the attack may have started with the compromise of an operations engineer’s computer. Elliptic notes that the Bybit case also began with a breach of a developer’s computer
【Questions】
· Limited overlap: According to Elliptic, only about $39,000 of the stolen Binance funds have so far flowed into the shared address. The attackers may simply have used the same laundering network; this does not prove they were the same group
· The speed is unlike North Korean groups: North Korean groups usually convert stablecoins within minutes. This time, however, more than $2.6 billion in stablecoins could not be converted in time and was frozen by the issuers
· Different methods: This time, large amounts went through market makers and lending protocols, unlike the Bybit case, which relied mainly on cross-chain bridges for laundering
· Key facts are missing: Binance has not disclosed how that computer was initially compromised
【Official statements】
· The government and law enforcement agencies have not publicly attributed the attack to anyone. The Bybit case received an official attribution within five days, but this one has not. Separately, sources familiar with the matter say that the FBI and other agencies are working with Binance
· Binance has not named any group, saying only that it is working with law enforcement to confirm the attackers’ identity. An update at 16:47 said that further investigation had uncovered other possible points of entry, that the attack was relatively complex, and that a detailed postmortem would be published later. Binance had previously said it had found no evidence that wallet private keys were leaked
· Frozen funds: Elliptic verified about $2.84 billion; Binance’s figure is about $3 billion
· Reimbursement: At 18:55, Binance said it had prepared more than $6.34 billion in company funds, of which more than $5 billion was already in the corresponding stolen assets. The rest was being purchased on and off the market, and replenishment had begun
· Withdrawals: Still proceeding as planned; at 16:47, Binance expected them to resume within 45 hours. Deposits are unaffected
【Market snapshot】
At 20:15 Shanghai time, Binance spot BNB was at $701.3, down 5.3% over 24 hours, with a low of $680; BTC was at $77,459, down 3.2%.
Takeaway: Who was behind the attack does not change the reimbursement outcome. Binance has prepared enough funds and started replenishing them. For BNB, the key question is whether withdrawals resume on schedule. In the short term, it is fluctuating above $680; don’t chase a short.
Which do you think is more likely: North Korean hackers carried out the attack themselves, or they simply used the same laundering network?
Disclaimer: This analysis is for reference only and does not constitute investment advice!
#BNB #币安被盗 #BinanceOracle
