How a single compromised laptop may have let hackers drain $6.3 billion from Binance in about 20 minutes

DW News reports that Binance, the world's biggest cryptocurrency exchange, says hackers affected more than $6 billion worth of digital assets, which the anchor describes as possibly the cryptocurrency industry's biggest ever theft.

One initial theory is that an engineer's laptop was compromised, allowing an attacker to make unauthorized withdrawals. The news rattled markets, and Bitcoin, Ether and other major cryptocurrencies fell sharply.

Moore, who researches emerging cybersecurity and AI threats with a focus on future cybercrime, says it is not yet known exactly how the attackers got into the laptop. He describes a pattern seen across the industry, particularly in cryptocurrency, in which attackers research prospective employees and pose as head hunters, sending messages via LinkedIn or email and inviting them to video calls.

Targets may be asked to download a link that appears to lead to Zoom or Teams. Moore says such links have been found to be packed with malware that can take control of a laptop. He stresses that the attack began with one laptop, because someone clicked on a link that downloaded the malware.

Moore says it is currently highly likely that a North Korea-linked hacking group is behind the attack. He says it resembles previous state-backed attacks, which are relentless in targeting companies. Such groups are not always after money; sometimes they only aim to monitor large companies and websites to see how they operate.

When they do pursue large sums, Moore says the theft disrupts markets and the money is often used to fund further cybercrime. He describes these actors as among the most sophisticated, and says that even a seemingly simple attack reflects considerable skill and knowledge. They continue approaching people until one gives in.

Moore says theft of this kind is a way of getting a lot of money in a very short space of time. The $6 billion heist is reportedly meant to have taken place within about 20 minutes, an amount that would be very difficult to steal from a bank in such a short period.

Large sums move between banks and crypto exchanges all the time. If a transaction does not raise an anomaly flag, it is allowed to proceed. Criminals who hijack the process can make their activity look genuine and get it through. Moore notes that some of the money has been frozen, but stolen funds do not immediately become usable. They are often moved through different cryptocurrencies and exchanges to obscure the trail, and ultimately converted into real currency, which he says may only be spotted potentially years later.

Binance says it will cover all losses. Moore says the attack undoubtedly damages trust in the crypto exchange market. On a personal level, he says, people should be especially wary of any communication, including emails and text messages pretending to be from Binance, which he describes as the biggest threat in the next week or so.

For people holding money on exchanges, Moore advises spreading assets between cold storage, such as a physical USB device held in one's hand, and a few reputable exchanges to minimize the risk of a single attack.

Asked what it says about the security of the whole crypto industry if the biggest exchange can be hit, Moore says this is the biggest worry. He says global regulation of crypto exchanges and currencies is not yet strong, and banks are trying to balance the future of crypto with their own traditions.

Moore points to privileged access as a weakness. People such as this developer need access to run their jobs, but if they are compromised and manipulated, control passes to someone rogue anywhere in the world. He says tougher regulation may slow the process down, but that such hurdles are required to minimize this in future.

Bitcoin and other major cryptocurrencies fell sharply after the news broke. Moore says cyberattacks always have ripple effects, and that cryptocurrency volatility can change market shares around the world. He warns of a danger of a crisis in confidence in cryptocurrencies, and says investors will probably be worried about where their money is.

Moore expects more attacks like this. He says AI tools are now looking for vulnerabilities every day, and that while defenders have similar tools, attackers have access to the same ones. He gives the example of a PHP vulnerability, present for 12 years and running on 70% of the world's websites, which AI spotted immediately before a patch was released, creating a race to update.

Moore says the best case is that funds are contained, security improves, and single points of failure are not seen again. The worst case, he says, is further losses, and especially losses that are not reimbursed, which would kill confidence again.

He praises Binance for saying it will reimburse losses, calling it a little help to those who woke up to find their wallets completely drained. He concludes that tighter regulation is ultimately needed and that governments around the world need to work together to make it happen.