SecurityNews
Binance reports $6.3bn stolen in what looks to be the biggest crypto hack yet
The exchange reports it froze about half the assets and will cover customer losses, while tracing firms point to a North Korean unit and Binance says its probe found more breach points than first thought.
What the reporting says
Binance said on Thursday that $6.3bn in digital assets was affected by what appears to be the biggest crypto hack ever recorded, according to BBC Technology. The company says roughly half the assets have been frozen and that it will cover all losses. Its early checks pointed to a compromised engineer's laptop, though it says later investigation found additional points of breach. Wired reports the theft ran across multiple blockchains and that Binance suspended deposits and withdrawals almost immediately. Several analytics firms, including TRM Labs and Elliptic, attribute the attack to North Korea's TraderTraitor unit, which Check Point says is also known as Lazarus Group. The Guardian notes that TRM expresses high confidence, while Elliptic's wording is that North Korea is likely responsible. The attribution comes from private firms, not from a government finding in these reports. CNET adds that Binance is cooperating with investigators from both the FBI and the Secret Service.
Read the original reporting
BBC Technology
Crypto giant Binance hit by $6.3bn hack suspected to be largest in historyMy Read
Commentary: opinion, not reporting.
The laptop detail caught my attention. Binance initially pointed to a single compromised engineer's laptop but now reports finding additional breach points. That's not unusual during an investigation, but it tells me the root cause is nowhere near fully understood. I find it hard to believe one compromised workstation could lead to billions in withdrawals. Apparently, there's more to this story.
What interests me is how the attack got past the safeguards that should protect customer assets. Good systems assume individual components will eventually be compromised. Independent approvals, separate devices, withdrawal limits. These are basic safeguards designed to prevent one breach from becoming a catastrophe. I don't know which Binance had or how they may have failed. Until there's an independent investigation, I'd treat their explanation as preliminary.
As for North Korea, several security firms agree, but agreement isn't proof. Binance also promises to cover customer losses, which is reassuring if it can back that up. Freezing half the assets is significant, but billions remain unaccounted for. My bigger question is how an exchange holding that much customer money allowed a security breach to escalate into a multibillion-dollar theft.
Discussion
If one compromised workstation can start a theft this large, what controls should an exchange be expected to prove it has?
Covered by 4 of 22 outlets we read, on Techmeme, 1,675 points on Hacker News.