Binance verifies reserves after $6.3B North Korea hack

The attacker behind the record $6.3 billion theft from Binance has started mixing stolen Bitcoin ↘ 0.96% for the first time. Since November 1, about 28 BTC (roughly $2.2 million) has gone through 18 CoinJoin transactions, according to blockchain analytics firm Elliptic. While the laundering spreads across more blockchains, Binance is trying to restore trust. On November 2 it said the cryptographic Proof of Reserves for 10 major tokens was finished, a day earlier than it had estimated, crypto.news reported.crypto.news+1

Laundering spreads across chains

Elliptic says that in under four days the laundering used about 12,000 wallets and more than 40,000 transactions across 11 blockchains. That works out to roughly one new wallet every 25 seconds. Of the $6.43 billion Elliptic counts as stolen, $2.85 billion is frozen. About $3.24 billion still sits in linked addresses, mostly as Ether and Bitcoin, and only a negligible amount has likely been cashed out, the firm said.elliptic.co

The attacker has also been converting Solana ↘ 1.02% into Bitcoin. On November 1, a wallet tied to the hack sent about 486,970 SOL, worth $46.4 million, through the cross-chain service Relay Protocol. That was part of a pool of 970,522 SOL valued at about $95.9 million, Brave New Coin reported, citing Lookonchain. Early on November 2, all 233 million stolen XRP ↗ 0.13% moved to six new addresses, Elliptic noted.bravenewcoin.com+1

The FBI said on October 31 that North Korea's TraderTraitor unit carried out the attack, and it flagged more than 600 linked addresses, SecurityWeek reported.securityweek.com

Reserves and withdrawals

The reserve proof covers Bitcoin, Ethereum ↘ 0.80%, Tether, BNB ↘ 0.26%, USDC USD Coin and five other tokens, all backed at least 1:1. Binance said it has replaced about 95% of the stolen assets. The remaining 5% is less-liquid tokens that are harder to buy, and more withdrawals are set to reopen from November 3, according to crypto.news. Customers took out a net $3.64 billion on Sunday, when withdrawals partly resumed. Binance said that was 2.1% of its assets, Reuters Thomson Reuters Corporation ↘ 3.79% reported.newsobserver.com+1

A laptop, not the code

The breach began on Thursday, October 29, and most of the funds were drained in about 20 minutes. Binance said its first findings point to a DevOps engineer's compromised laptop, which gave the attacker access to its service containers, SBS reported. The exchange has said wallet private keys were not exposed, crypto.news noted.news.sbs.co.kr+1

Security experts say the blockchain's cryptography held up. "Crypto is best described as cryptographically strong but operationally weak and fragile," Govind Rammurthy, CEO of eScan, told India Today. "Attackers have long stopped trying to beat the maths."indiatoday.in