Hackers have stolen about $6.3 billion worth of digital assets from Binance, a major cryptocurrency exchange operator.

The heist is more than four times bigger than the previous largest crypto theft. TRM Labs Inc., a venture-backed blockchain intelligence startup, believes that both cyberattacks were carried out by a North Korean state-backed hacking group tracked as TraderTraitor.

About 40% of the stolen sum comprised stablecoins issued by three major crypto companies: Circle Internet Group Inc., Ripple Labs Inc. and Tether Ltd. They managed to freeze most of the funds before the hackers moved them out of reach. Binance, for its part, has set aside over $6.34 billion to cover users’ losses.

The hackers stole the funds by compromising several of the company’s wallets. One of them powers the infrastructure that Binance uses to process customers’ Ethereum transactions. According to TRM, the hackers breached the wallet late Thursday and sent its entire balance to a wallet they controlled.

TraderTraitor compromised Binance’s wallet by exploiting an Ethereum feature called EIP-7702 that the blockchain’s maintainers released last year. It enables a snippet of code called a smart contract to temporarily control a wallet. EIP-7702 only activates smart contracts if they receive authorization to run from the wallet’s operator. That authorization takes the form of an encrypted message.

The hackers used a malicious smart contract to take over Binance’s Ethereum wallet. It’s currently unclear how they obtained the authorization necessary to run such code. According to Binance, an internal investigation determined that TraderTraitor had compromised a laptop belonging to one of its DevOps engineers. The company says that it has also “uncovered additional points of breach.”

“Developer and DevOps machines sit close to organizations’ most sensitive systems and hold credentials, tokens and deployment access,” said Kobi Sivilya, the Chief Information Security Officer of cybersecurity company Checkmarx Ltd. “The question for any organization is how far an attacker could get from a single compromised workstation. Teams should review who has standing access to what systems, whether that access is appropriately limited and whether one machine can reach critical services without a second control.”

TRM determined that TraderTraitor had rehearsed the cyberattack for at least 36 hours before the theft. On Wednesday morning, the hackers deposited a small amount of funds into a malicious crypto wallet. Early Thursday, they tested some of the code that they used in the cyberattack on three different wallets.

According to Binance, the malware contained a “self-destruct mechanism” that deleted the tools the hackers installed on its infrastructure and the activity logs they generated. The mechanism made it more difficult for the company to investigate the attack. Binance did, however, determine that the hackers bypassed the approval workflows it uses to process crypto outflows.  

Binance suspended crypto deposits and withdraws on its exchange after it discovered the breach. The company has since restored deposits, but its withdrawal processing system remains offline. Binance plans to reactivate the feature on Monday.

Photo: Unsplash