“We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%,” Binance co-CEO Richard Teng posted on X, adding that “Our users will not bear the financial impact of this incident.”
“Binance said it was able to replace the funds taken in the record hack by using company money to buy new tokens,” reports NBC News:
The remaining 10% consists of tokens that are less liquid, meaning they may take longer to buy, it said in a statement posted on X… Binance said it has set aside around $6.34 billion of company funds internally to cover the losses. The money spent re-buying tokens came from using part of its $1 billion Secure Asset Fund for Users, a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund, and the company’s own corporate treasury, it said on X.
NBC News reports that the FBI blames the breach on a North Korea-sponsored group known as TraderTraitor:
Members of [TraderTraitor] were observed by law enforcement converting stolen assets into the cryptocurrency ethereum, the FBI said in a statement, adding that it expects “further laundering” of the assets through the use of related technology… After the hack, the exchange stopped allowing customers to withdraw their funds, but it said Saturday it was still on track to reopen withdrawals Sunday.
CNBC reports:
The world’s largest crypto exchange initially said the hack may involve “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer’s permissions.
The New York Times describes what happened when Binance first spotted “a multibillion-dollar deluge of digital coins” pouring out of its accounts:
As the news spread, Binance’s top executives put together an informal war room on Wea, the company’s internal messaging system, with about 100 participants, including specialized cryptocurrency tracers and security personnel. They eventually transitioned to a mass conference call, with 100 boxes on the screen, where employees took turns muting and then unmuting, communicating in a mixture of English and Chinese. Among them was He Yi, Binance’s co-chief executive, who is seven months pregnant, and worked through the night from her base in Abu Dhabi, taking a call at 3 a.m. local time….
Much of the drama played out in public. Almost all crypto transactions are recorded on the blockchain, a ledger of money movements that anyone can look up. That meant crypto analysts could see funds leaving Binance in real time… North Koreans have targeted crypto companies for years, using the proceeds of those thefts to fund its nuclear program, according to Western officials. The hackers have developed increasingly complex strategies to steal crypto and launder the proceeds, a painstaking endeavor that can take months to complete. In a blog post on Friday, Chainalysis said the attackers had deployed “laundering patterns we have not seen before,” conducting thousands of transactions over a short period, probably with the help of automation.
At the same time, Binance’s colleagues in the industry mobilized to intercept some of the laundered crypto. Certain digital coin issuers can freeze funds, allowing them to halt a money-laundering operation in its tracks. Soon after the hack, Tether and Circle, two major issuers, announced that they had frozen stashes of their own coins that the hackers had seized from Binance, a combined total of more than $2 billion in crypto. Binance is now working to gain access to those funds, the company said. But $2.4 billion in crypto is already “beyond any issuer’s reach,” according to [blockchain intelligence firmm] TRM.
The article also includes President Trump’s reaction when asked Friday about the breach. “I’ve always felt it was a little bit dangerous. But they say they have it pretty much under control. We’ll see.”