Twenty minutes is all it took to pull off the biggest cryptocurrency heist in history.
About $6.3 billion worth of cryptocurrencies was quickly swiped Oct. 29 from wallets that crypto exchange Binance holds and uses to process transactions, the exchange and blockchain analysis firms said. Binance said it froze all withdrawals and about $3 billion worth of crypto on the public blockchain to investigate what happened.
The hack shows that even the world's largest crypto exchange can be exposed to theft, and consumers need to be aware and vigilant about how they store their crypto, analysts said.
"An exchange account isn't a bank account," said David Gokhshtein, who covers crypto daily as founder of Gokhshtein Media. "Keep what you trade on an exchange and
what you hold long term in your own wallet. That's the lesson."
How did hackers steal $6.3 billion of crypto from Binance?
Initially, Binance thought the heist involved a compromised laptop, but further investigation uncovered multiple points of breach, it said on X. Hackers used Binance's "signing infrastructure," which authorizes transactions and issues instructions, that emptied the wallets housing customer deposits the exchange uses for transactions, said U.S. blockchain analytics firm TRMLabs in a blog.
The attack was well planned, with smaller rehearsal thefts in the 36 hours leading up to the Binance heist, TRM said. It attributes the attack to TraderTraitor, North Korea’s premier hacking unit.
"We base this assessment on robust on and off-chain intelligence sources," TRM wrote. "Several features of this attack match earlier North Korea-linked heists," including small withdrawals funding an operator wallet, staging that began well before the theft and signatures obtained in advance then executed in one burst.
Though $6.3 billion moved out of Binance, issuers quickly reacted and within an hour or so froze all but $60 million of the digital assets so they couldn't be deposited, cashed out or spent.
Still, thieves managed to move fast and swap $60 million of stolen Tether stablecoin to Ether on Aave, a decentralized platform that lets users pool crypto to lend, borrow and earn interest, said Iman Shafiei, founder of educational platform and research firm Keystone Research Group. TRM said this type of swap to launder the crypto was different from earlier crypto thefts.
The bulk of the stolen crypto remains frozen and, likely recoverable, but could take decades, Shafiei warned. "They can’t unfreeze the crypto without proper court orders, and that could take years," he said.
In the Mt. Gox bitcoin exchange case, one of the earliest crypto hacks, distributions didn't even begin for a decade and remain ongoing, Shafiei noted. "Distributions are done in batches," he said.
Meanwhile, Aave users whose Ether were loaned to the hackers "had no idea (the Tether assets) was stolen until Tether, the company that issues the stablecoin of the same name blacklisted it," Shafiei said. "So those people holding onto the stolen funds are out" of their crypto. At some point, Aave users will have to be compensated, too, he said. Aave has a built-in insurance pool it set up that it can tap for these types of situations, he said.
Crypto, unlike cash deposits in banks, are not federally insured.
Can this happen again?
With technology and artficial intelligence (AI) gaining prominence, analysts expect more and even bigger attacks in the future.
"A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI," said Andy Ward, senior vice president international at cyber security firm Absolute Security. "Cyber threats are becoming more sophisticated and widespread as ever, and it is likely only a matter of time before an even larger hack, with even greater financial fallout, makes headlines."
With that in mind, financial institutions need to focus on ensuring each hack doesn't result in massive losses, analysts said.
“This demands a fundamental change in thinking," said Phoebe Hodgson, banking and payments senior analyst at GlobalData research firm. "The next generation of cyber resilience will be defined not by whether institutions can prevent every breach, but by whether they can stop attackers from turning that breach into irreversible financial loss.”
What can consumers do to protect their wallets?
The best protection for digital assets is to keep them to yourself and not store them on any centralized exchange such as Binance, crypto experts said.
"Exchanges are for buying or selling, not storing," Shafiei said. "Exchanges are the biggest honeypot because (thieves) can access billions through one log in."
Instead, consumers should store their crypto in their own wallets, he said. There are two ways to do that:
- Software wallet: These are free, downloadable online and can hold most types of crypto, Shafiei said. When you sign up, you'll get a recovery phrase of 12-24 words in a specific sequence to activate it. "Keep that safe, don't share it," he said. "You can’t access the wallet without that phrase. Even AI computers can’t hack it."
- Hard wallet: A piece of hardware that you plug in and out of an outlet that stores crypto. The crypto can only be accessed through this hardware when plugged in. It comes with a recovery phrase for set up that you can use on another device in case something happens to your first one, like you spill coffee on it. Each time you log in, you also must enter your secret pin. Shafiei recommends Trezor hard wallets ($50 to $250), but regardless of which you choose, "it's very important to only buy it from the real manufacturer website and not a third party like Amazon because people could tinker with it." When it arrives, it should have a safety seal on it like pharmaceutical drugs.
Consumers can also use both. Shafiei said he uses the hardware wallet to hold assets like he would a bank account. It's more secure because of its on and offline feature, and he keeps that in a safety deposit box. He uses the wallet like a cash wallet he would carry around everyday, with only about $100 in it.
Medora Lee is a money, markets and personal finance reporter at USA TODAY. You can reach her at mjlee@usatoday.com and subscribe to our free Daily Money newsletter for personal finance tips and business news every Monday through Friday morning.
This article originally appeared on USA TODAY: The $6.3B Binance heist – is your crypto safe on exchanges?
