The Epic Crypto Heist: Inside North Korea’s Unprecedented Cyber Operation

The organization revealed that the funds utilized for asset buybacks originated from three different channels: a portion of its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve established to safeguard clients from security vulnerabilities, as well as contributions from its futures insurance pool and the company’s internal reserves.

Binance stated that it had conducted a fresh snapshot of its assets at midnight on October 31 as part of its proof-of-reserves initiative, aimed at confirming that the exchange possesses sufficient assets to cover customer deposits. Once the comprehensive verification is completed, customers holding any of the 10 designated cryptocurrencies will be able to verify that their assets are supported by reserves at a minimum ratio of 1:1. These cryptocurrencies include Bitcoin, Ethereum, Tether (USDT), BNB, Solana, USDC, XRP, USD1, RLUSD, and ZEC.

The company disclosed that the initial phase would commence on Sunday morning, encompassing Bitcoin, Ethereum, BNB, Solana, XRP, Dogecoin, among other cryptocurrencies. In a statement shared on X late Saturday, Binance indicated that the remaining 5% includes less liquid assets, which might require more time to obtain in sufficient volumes.

Earlier that same Saturday, after recovering 90% of the stolen assets, Richard Teng, one of Binance’s co-CEOs, posted on X, stating: “We have now restored 90% of the stolen assets, and we are committed to covering the remaining 10%. Our users will not incur any financial losses from this incident.”

For years, Pyongyang has denied utilizing state-sponsored cyber units for espionage, theft, and generating revenue. The North Korean diplomatic mission in Geneva and its embassy in China did not respond to inquiries for comments.

Two prominent blockchain analysis firms, TRM Labs and Chainalysis, have also connected the attack to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. Both organizations expressed a high level of confidence in their analyses, citing intelligence and patterns similar to previous cybersecurity incidents.

Experts claim that Kim Jong Un’s regime is heavily reliant on cybercrimes to fund its operations. North Korea is considered one of the least affluent nations globally, and internet access there is extremely limited. The bulk of its hacking activities have financial motivations.

Although not driven by financial gain, North Korea’s most infamous cyberattack targeted Sony Pictures in 2014. The studio had produced “The Interview,” a film featuring a plot to assassinate Kim. This breach led to the leakage of thousands of unflattering emails exchanged by top studio executives.

Reports indicate that North Korea has systematically enhanced its cyber abilities by recruiting top university students and assigning them to hacking teams managed by its intelligence agency. Analyses from tech companies suggest that some of its cyber operations are conducted from locations in China.

On Friday, Teng described the breach as a “sophisticated attack,” highlighting the use of an infected laptop and malicious software aimed at erasing any traces of the hackers’ activity, complicating investigation efforts.

Initially, the company suspected that unauthorized withdrawals were facilitated by an engineer’s compromised laptop, only to later realize that the breach was broader than initially thought. “The preliminary investigation suggested the security incident could be linked to a compromised laptop; however, additional investigation revealed further entry points,” Binance stated.

Suspicions are that North Korean operatives exploited special access rights to manipulate one of Binance’s “hot wallets,” online wallets designed to store cryptocurrencies, leading to automatic fund transfers to the attackers.

As per TRM Labs, the attackers likely acquired the authority to authorize transactions via Binance’s hot-wallet signing mechanism. Chainalysis noted that the hackers employed “unprecedented laundering techniques,” evidently using automated methods to obscure the path of the misappropriated funds.

Experts suggest that the advent of artificial intelligence has introduced new mechanisms for criminal activities, including automation and innovative approaches. They believe that AI was likely leveraged in this case to infiltrate systems.

In the aftermath of the breach, the exchange suspended all customer withdrawals. Binance reported that it has earmarked around $6.34 billion in corporate funds to reimburse the losses incurred.