The $6.3bn Binance hack explained — 5 things you need to know

It's the largest cryptocurrency theft in history : hackers from North Korea allegedly swiped $6.36 billion in funds from Binance in the space of just 20 minutes, which has left customers reeling and the financial industry in shock.

<![CDATA[ <article> <p>It's the largest cryptocurrency theft <a href="https://www.techradar.com/pro/security/binance-hit-by-largest-crypto-theft-on-record-as-north-korean-hackers-steal-usd6-3bn-in-just-20-minutes">in history</a>: hackers from North Korea allegedly swiped $6.36 billion in funds from Binance in the space of just 20 minutes, which has left customers reeling and the financial industry in shock.</p><p>The heist raises all kinds of questions about how this was allowed to happen, what might happen next, and whether Binance customers are going to get any of their stolen money back. </p><p>Even if you never owned any cryptocurrency before, there are bigger questions too — like what this means for global financial stability, and what the aftershocks might be for everyone outside the Binance world.<br /><br />Looking for a quick five-minute primer on the Binance hack? We've been speaking to industry experts to get some answers...</p><h3 class="article-body__section" id="section-1-what-actually-happened"><span>1. What actually happened?</span></h3><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:2560px;"><p class="vanilla-image-block" style="padding-top:56.25%;"><img id="HZnejd5A9BSpzHMksgQV4H" name="GettyImages-2302659527" alt="A phone showing the Binance logo in front of a stock market tracker" src="https://cdn.mos.cms.futurecdn.net/HZnejd5A9BSpzHMksgQV4H-1920-80.jpg" mos="" align="middle" fullscreen="" width="2560" height="1440" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Getty Images / Dan Kitwood)</span></figcaption></figure><p>The basics are now pretty clear — $6.36 billion in cryptocurrency was stolen from the Binance exchange in the space of just 20 minutes. Security analysts are pointing the blame at North Korea's TraderTraitor hacking group, which has a history of this kind of heist. What's less clear is exactly how the hackers got access. Early reports identified a Binance employee's compromised laptop as a potential way in, though it now seems there's more to the story.</p><p>"A compromised laptop may explain where an attack started, but it does not, on its own, explain how billions of dollars could leave an exchange," Pieter Arntz, researcher at cybersecurity firm <a href="https://www.malwarebytes.com/" target="_blank">Malwarebytes</a>, told TechRadar. "The real question is what allowed that initial foothold to become access to withdrawal systems — and which safeguards failed to stop unauthorized transactions."</p><p>"According to blockchain analysts, the attacker spent at least a day and a half preparing, including testing their tools on public blockchains where anyone could see," Ben Bernstein, manager of cybersecurity advisors at <a href="https://www.huntress.com/" target="_blank">Huntress</a>, told TechRadar. "Then most of the $6.3 billion left Binance's wallets in about 20 minutes. That's common in attacks we investigate. The attacker does most of the work long before anything is stolen."</p><h3 class="article-body__section" id="section-2-will-anyone-get-their-money-back"><span>2. Will anyone get their money back?</span></h3><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:970px;"><p class="vanilla-image-block" style="padding-top:56.19%;"><img id="TxJUR62qaBrKS9MKbPJoUP" name="shutterstock_1086334076.jpg" alt="Binance Coin" src="https://cdn.mos.cms.futurecdn.net/TxJUR62qaBrKS9MKbPJoUP-1920-80.jpg" mos="" align="middle" fullscreen="" width="970" height="545" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="caption-text">Binance says customers will be refunded </span><span class="credit" itemprop="copyrightHolder">(Image credit: Shutterstock / Diego Ioppolo)</span></figcaption></figure><p>Binance has promised to reimburse customer losses through its backup and emergency funds, but in the meantime we're seeing deposits and withdrawals frozen on the platform while the hack is investigated. It's a warning that even the largest and most sophisticated exchanges can still be vulnerable.</p><p>"Binance says it'll cover every cent," Nigel Green, CEO of <a href="https://www.devere-group.com/" target="_blank">the deVere Group</a>, said in a press statement. "I hope so. The emergency fund is around $1.2 billion and the gap is several times bigger, so the rest has to come from the company’s own balance sheet. The market will want to see the numbers, and the new proof of reserves can’t come soon enough."</p><p>"Long term holders have just been reminded, very expensively, why keys kept offline matter. Crypto has spent years pushing back against heavy regulation, and plenty of those arguments were fair. This one's harder to argue with. Platforms holding billions of other people's money need enforceable security standards. I expect regulators in the US, Europe and Asia will likely move faster after this week," he added.</p><p>In the meantime, the US Secret Service has said in a statement that it's "working around the clock" with partners in the private sector "to identify, freeze, trace, and recover funds" that have been stolen from Binance.</p><h3 class="article-body__section" id="section-3-what-follow-up-scams-might-appear"><span>3. What follow-up scams might appear?</span></h3><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:1920px;"><p class="vanilla-image-block" style="padding-top:56.25%;"><img id="H3JYvKxouWY6CRB6KEEw2a" name="GettyImages-1603729912.jpg" alt="Man holding a mobile phone with warning notification and spam message icon" src="https://cdn.mos.cms.futurecdn.net/H3JYvKxouWY6CRB6KEEw2a-1920-80.jpg" mos="" align="middle" fullscreen="" width="1920" height="1080" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Getty Images)</span></figcaption></figure><p>Whether you're a Binance customer or not, you need to keep your wits about you over the next few days. It's likely that scams trying to literally cash in on the hack will start appearing — perhaps warning you that you need to quickly claim refunds, lock your account against a particular threat, or go through a bogus verification process.</p><p>"Criminals routinely use major breaches as a hook for phishing campaigns," Dray Agha, senior manager for tactical response at <a href="https://www.huntress.com/" target="_blank">Huntress</a>, told TechRadar. "Consumers should be highly suspicious of any emails or messages claiming to be from Binance offering urgent account recovery steps. You must only check your account status through the official application or website rather than clicking links in unsolicited messages."</p><p>According to the team at Huntress, you should watch out for social media posts, emails, and text messages that use the Binance hack as a hook — perhaps a fake news story suggesting that now's the time to buy crypto, while prices are down. </p><p>As always, think twice about following links or entering sensitive information into online forms and portals you're not familiar with.</p><h3 class="article-body__section" id="section-4-how-does-this-affect-the-average-consumer"><span>4. How does this affect the average consumer?</span></h3><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:1920px;"><p class="vanilla-image-block" style="padding-top:56.25%;"><img id="AboNpeASJNf5nBHAARoLnF" name="Computer hack warning.jpg" alt="A laptop with digitally inserted hack warnings around it" src="https://cdn.mos.cms.futurecdn.net/AboNpeASJNf5nBHAARoLnF-1920-80.jpg" mos="" align="middle" fullscreen="" width="1920" height="1080" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="caption-text">The hack shouldn't give you any financial surprises </span><span class="credit" itemprop="copyrightHolder">(Image credit: Getty Images)</span></figcaption></figure><p>If you don't own any cryptocurrency, the good news is that you're largely going to be unaffected by what's happened here. There's not going to be a stock market crash, or a run on the banks, or a global recession — not because of this hack, at least. However, it's always worth weighing up your own personal privacy and security setup.</p><p>"If you don't own crypto, the direct impact on you is small," Ben Bernstein from Huntress told us. "Your bank account and your card are not affected by this. The bigger takeaway for consumers is that attackers often get in by targeting people rather than technology, through a convincing email, a fake login page or a phone call from someone posing as IT support," he said.</p><p>"That makes security awareness everyone's job, at home and at work. If you pause before you click a link, approve a login or share a code, you're making it harder for an attacker, whether they're after your savings or your employer's systems," he added.</p><h3 class="article-body__section" id="section-5-what-does-this-mean-for-the-future-of-money"><span>5. What does this mean for the future of money?</span></h3><figure class="van-image-figure inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:2560px;"><p class="vanilla-image-block" style="padding-top:56.25%;"><img id="NaCB8pmsc8XsFynXT6qrDa" name="GettyImages-2302659444" alt="The Binance logo in front of a stock market line graph" src="https://cdn.mos.cms.futurecdn.net/NaCB8pmsc8XsFynXT6qrDa-1920-80.jpg" mos="" align="middle" fullscreen="" width="2560" height="1440" attribution="" endorsement="" class="inline" /></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Getty Images / Dan Kitwood)</span></figcaption></figure><p>This clearly raises a lot of questions about the safety of cryptocurrency and the exchanges that it sits on — and of course it's far from the first crypto heist <a href="https://www.techradar.com/pro/security/hackers-steal-over-usd1bn-in-one-of-the-biggest-crypto-thefts-ever">we've seen</a>. In the longer term, it may lead to less confidence in crypto as a whole, but the experts we spoke to don't think it will bring the industry down. What will be important is making sure the risks of this happening again are minimized as much as possible.</p><p>"Despite the scale of the theft, this is not a threat to global financial stability," Feike Hacquebord, Principal Threat Researcher at <a href="https://www.trendaisecurity.com/en-gb/?utm_source=google&amp;utm_medium=cpc&amp;utm_campaign=ent_brand+general_lg_e_ukie_wg_ao_search&amp;gad_source=1&amp;gad_campaignid=20549377892&amp;gbraid=0AAAAADnY1BvBRM2ja1Cb1gIdqxw09vDJ-&amp;gclid=CjwKCAjw6rfSBhAqEiwA_yocplOw-CRKs4xOmjzxgSrfhcO6onSMjr57VO8bhAPnqTxE8I8JRvYzZBoCSC0QAvD_BwE" target="_blank">TrendAI</a>, told TechRadar. "Around half of the stolen funds have already been frozen, while the regulated banking system is well equipped to absorb a shock of this size. This is a major crisis for Binance, not a crisis for the global financial system."</p><p>"The change I’d like to see, for crypto firms, banks and every other business, is working on the assumption that someone will get in eventually," Ben Bernstein told us. "Keeping attackers out matters, but it isn't enough on its own. Companies also need someone watching around the clock, especially for logins and account activity that don't look right, so they can find and remove an intruder before the money starts moving," he added.</p> </article> ]]>