World’s largest crypto exchange hit by world’s largest heist

Hollie Adams/Reuters

Hackers stole over $6 billion in cryptocurrency on Thursday, shattering the record for the largest such heist as multiple investigators pointed the finger at North Korea.

As of Thursday night in the US, a team of cryptocurrency firms had managed to freeze about $3 billion of the stolen loot amid a frenetic battle with the hackers to find and control the digital money.

The hackers broke into digital wallets held at Binance, the world’s largest crypto exchange.

Binance said late Thursday that its initial investigation indicates that the incident occurred through a hacked engineer’s laptop, “which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Binance said it would “cover all losses” from “the company’s funds” and an emergency assets fund, adding “user funds are safe.” The crypto exchange also said it had “temporarily suspended deposits and withdrawals while security checks are completed; revoked the affected address authorization; [and] engaged law enforcement and blockchain intelligence partners to trace and recover funds.”

Analysts were shocked by the amount of money impacted.

“It’s the biggest hack in history,” Aravind Srinivasan, head of large crypto market maker GSR’s systematic OTC business told Reuters.

Crypto-tracing firm TRM Labs attributed the heist to an elite North Korean hacking unit, “based on robust on and off-chain intelligence.”

Pangolin Intelligence, another blockchain-tracking firm based in Singapore, said it also believed that a North Korean hacking unit was behind the heist.

“Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents [from the North Korean cyber unit]” led to the attribution, said an analyst with Pangolin Intelligence, who did not want to be named for privacy reasons.

“I think the cat and mouse game has barely begun yet,” the Pangolin Intelligence analyst told CNN, adding that North Korea was likely poised to tap a network of money laundering organizations to try to cash out the stolen funds.

Chainalysis, another crypto-tracking company, said it was monitoring stolen funds “moving across multiple blockchains,” including Bitcoin and Ethereum. A Chainalysis spokesperson told CNN the firm had “high confidence” North Korea was behind the hack.

CNN has reached out to North Korea’s mission at the UN for comment. Pyongyang has previously denied hacking allegations.

CNN has requested comment from the FBI, as well as the US Secret Service, which also investigates cybercrime. In past investigations of big crypto-hacks, the FBI has had an on-call team of analysts that worked to freeze some of the money.

If North Korea is proven to be the culprit, it would be little surprise to US law enforcement officials and private experts. North Korean hackers were blamed for the previous record-high crypto hack, when they allegedly stole $1.5 billion from Bybit, another major cryptocurrency exchange. In that case, the attackers stole a significant portion of North Korea’s reported annual gross domestic product in a matter of minutes.

North Korea’s formidable hacking teams are a key source of revenue for the nuclear-armed, sanctions-battered regime, according to current and former US and South Korean officials. Pyongyang-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in the last several years, according to reports from the United Nations and private firms.

A 2023 CNN investigation spotlighted how the South Korean intelligence service worked with private crypto-tracking experts to seize about $1 million in cryptocurrency that North Koreans had stolen from a victim.

霍莉·亚当斯/路透社

周四，黑客窃取了价值超过 60 亿美元的加密货币，打破了此类盗窃案的最大纪录，多名调查人员将矛头指向了朝鲜。

截至美国周四晚间，在与黑客展开激烈争夺并试图控制这些数字货币的过程中，一家加密货币公司组成的团队已成功冻结了约 30 亿美元的被盗赃款。

黑客入侵了全球最大的加密货币交易所币安的数字钱包。

币安周四晚间表示，初步调查显示，该事件是通过一名被黑客入侵的工程师的笔记本电脑发生的，“这使得攻击者能够访问服务容器并提交未经授权的提现交易”。

币安表示，将动用公司资金和紧急资产基金“弥补所有损失”，并补充说“用户资金安全”。这家加密货币交易所还表示，已“暂时中止充值和提现，等待安全检查完成；撤销了受影响地址的授权；并已与执法部门和区块链情报合作伙伴合作，追踪和追回资金”。

分析师们对受影响的金额之大感到震惊。

“这是历史上最大的黑客攻击，”大型加密货币做市商 GSR 系统性场外交易业务负责人 Aravind Srinivasan 告诉路透社。

加密货币追踪公司 TRM Labs 将这起盗窃案归咎于朝鲜的一支精英黑客部队，“基于强大的链上和链下情报”。

另一家总部位于新加坡的区块链追踪公司 Pangolin Intelligence 表示，他们也认为朝鲜黑客组织是这起盗窃案的幕后黑手。

一位不愿透露姓名的穿山甲情报公司分析师表示：“通过分析与此次黑客攻击相关的链上活动，并将其与从之前已知的事件（来自朝鲜网络部队）中收集的信息进行比对”，最终确定了攻击来源。

“我认为这场猫鼠游戏才刚刚开始，” Pangolin Intelligence 的分析师告诉 CNN，并补充说，朝鲜很可能准备利用洗钱组织网络来兑现被盗资金。

另一家加密货币追踪公司Chainalysis表示，他们正在监控被盗资金“在多个区块链上流动”，包括比特币和以太坊。Chainalysis发言人告诉CNN，该公司“高度确信”朝鲜是此次黑客攻击的幕后黑手。

CNN已联系朝鲜常驻联合国代表团寻求置评。平壤此前否认了黑客攻击指控。

CNN已向联邦调查局（FBI）以及同样负责调查网络犯罪的美国特勤局（USSS）请求置评。在以往对大型加密货币黑客攻击的调查中，FBI曾组建一支随时待命的分析团队，负责冻结部分被盗资金。

如果朝鲜被证实是罪魁祸首，美国执法官员和私人专家都不会感到意外。此前，朝鲜黑客就曾被指控发动了史上金额最高的加密货币黑客攻击，据称他们从另一家大型加密货币交易所Bybit窃取了15亿美元。在那起案件中，攻击者在短短几分钟内就窃取了朝鲜公布的年度国内生产总值（GDP）的相当一部分。

据现任和前任美国及韩国官员称，朝鲜强大的黑客团队是这个拥有核武器且饱受制裁的政权的重要收入来源。联合国和多家私营公司的报告显示，与平壤有关联的黑客在过去几年中从银行和加密货币公司窃取了数十亿美元。

2023 年 CNN 的一项调查重点报道了韩国情报部门如何与私人加密货币追踪专家合作，追回了朝鲜人从受害者那里窃取的约 100 万美元加密货币。