Binance is still piecing together how hackers made off with an estimated $6.3 billion in crypto, but investigators have already identified two important parts of the story: the attack has been linked to North Korea’s TraderTraitor hacking group, and an Ethereum upgrade gave the attacker a way to empty one of the exchange’s largest hot wallets in a single transaction.

The theft unfolded across 10 blockchains yesterday, with most funds leaving Binance-controlled wallets in roughly 20 minutes, according to a report from TRM Labs. Binance initially pointed to a single compromised DevOps engineer’s laptop, but later said there were additional points of breach in a complex attack process. The specifics of how the attacker gained sufficient authority for the related transactions from Binance’s wallets remain unclear.

Bottom line – your money is safe, and we're covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…

Binance now estimates the total impact at approximately $6.3 billion (around $3 billion of which has been frozen by various third parties) and says it will cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds.

Binance’s first public explanation of what happened pointed to a laptop belonging to a DevOps engineer. Late last night, the exchange said its preliminary investigation suggested that the compromised laptop allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance added that it found no evidence private keys had been leaked.

Source link