The first question that comes to mind after hearing that Binance, the world’s largest cryptocurrency exchange, was hacked to the tune of $6.2 billion is: How the heck can this even happen?
The hack, which lasted several hours, saw the attacker drain Binance’s wallets, with hundreds of millions of dollars in BTC, ETH, USDC, USDT, and other cryptocurrencies.
The total tally, according to Binance co-CEO Richard Tang, was $6.3 bililon. Crypto sleuth Wazz put it at $6.17 billion by following crypto wallets, and Binance founder Changpeng ‘CZ’ Zhao didn’t share the actual number, but he did confirm the ballpark.
This Tweet is currently unavailable. It might be loading or has been removed.
The first news from Binance about the nature of the hack revealed that the company’s wallet private keys had not been leaked. Instead, it was a compromised DevOps engineer’s laptop that the hacker used to “gain access to a service container and submit unauthorized withdrawal transactions.”
If you’re a Binance user, this doesn’t sound comforting. If a single compromised laptop can result in billions being stolen, Binance had better rethink its security practices.
Now, however, Tang shared some additional details about the incident. While reiterating that customer funds are “safe,” he said that the hack was a bit more involved than what the statement above implies.
This Tweet is currently unavailable. It might be loading or has been removed.
“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” wrote Tang.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak,” he wrote, adding that the company will share a “detailed technical post-mortem once the investigation is complete and every fact is verified – and publish an updated Proof of Reserves once remediation is complete.”
Furthermore, according to the BBC, Binance has uncovered “additional points of breach,” so it may not be just the one laptop that was compromised.
This Tweet is currently unavailable. It might be loading or has been removed.
Fortunately for Binance and its users, a substantial portion of the stolen funds has been frozen by the issuers. In response to Elon Musk’s snarky comments about the incident, CZ said that roughly $3 billion in funds has been frozen. The company also has a SAFU fund worth more than $1 billion, and CZ pointed out that the company holds more than $1 billion in SpaceX shares, in an obvious jab at Musk.
Want more tech and digital culture news delivered to your inbox daily or sent straight to your device? Sign up for Mashable’s Top Stories newsletter or get Mashable push alerts today.
