How North Korean hackers pulled off $6.3B Binance heist — inside job, AI-powered techniques could have been at work

A notorious North Korean hacking unit may have compromised a single Binance employee’s laptop to pull off the record-breaking $6.3 billion hack of the cryptocurrency exchange – indicating a potential inside job or a stunning AI-powered infiltration of the company’s software.

Binance, the world’s largest crypto exchange, initially said the digital theft of the century may have centered on an engineer’s laptop, later adding that it identified “additional points of breach” – suggesting a complex attack carried out by more than one person. 

Ido Ben-Natan, CEO of Blockaid, which was the first party to identify Thursday’s attack, within just two minutes of the drain, said he wouldn’t rule out an inside job.

“In order to penetrate the network, phishing is one option or getting someone hired at Binance,” Ben-Natan told The Post.

However, he said North Korean hackers most likely leveraged artificial intelligence. AI models are increasingly able to detect crypto exchanges’ unknown software flaws – known as “zero-day vulnerabilities” — enabling hackers to carry out much larger heists.

Crypto hacks have been growing larger and more frequent, with roughly $1.2 billion stolen in 255 attacks from July to September – up from $822 million in 222 incidents from April to June, according to data from blockchain security firm CertiK.

TraderTraitor, the North Korean cybercrime group suspected of the record-breaking Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.

Crypto exchanges are easy targets for hacking groups like TraderTraitor, since digital assets can be transferred around the world much faster than any physical asset, and with a degree of anonymity – making them much more difficult to recover.

“They tried more than 50 times” to get into the exchange, Ben-Natan said.

Once inside, the hackers started draining crypto accounts, a process that took just 20 minutes, then scrambled to send the riches to different networks around the world, he said.

“This attack was done by North Korea, that’s clear,” Ben-Natan said. “Any time there is a hacking like this, money starts being sent everywhere as quickly as possible.”

Richard Teng, co-CEO of Binance, said Friday that the hackers “also used a self-destruct mechanism … making it more difficult for us to trace and investigate.” 

Hackers typically rely on social engineering, software hacks or some sort of combination. 

In the first instance, attackers trick humans – like employees at the company – into giving them access to private systems by sending scam emails or messages. They might also steal employee credentials or passwords. 

Idan Ofrat, co-founder of Fireblocks said it was likely that the hackers used “a phishing attempt like a LinkedIn message or email. With the right security practices, all of this could have been prevented.”

Hackers might also target weaknesses in an exchange’s blockchain to disable security controls. One example is when attackers steal cryptographic keys that authorize transactions, allowing them to move funds out of crypto wallets without the necessary passwords.

After an attack, hackers rush to launder money to avoid losses from currency being frozen – one example is putting crypto into a decentralized lending market. Hackers can still take out loans based on the amount even if currencies are frozen.

The crypto exchange added that it’s on track to allow customers to make withdrawals within two days and that it has set over $6 billion of company funds aside to cover customers’ losses.

Blockchain transactions are permanently recorded, which allows officials to track stolen funds as they move between wallets and exchanges. Centralized crypto exchanges and stablecoin providers have the ability to freeze assets on their platforms. 

But freezing assets is not the same as recovering them. Since the industry is still largely unregulated, getting back stolen funds can be a long and tedious process, involving cooperation from crypto exchanges, token issuers and law enforcement.

Absent such cooperation, the digital moolah is gone for good.