$6.3 billion gone in 20 minutes: Binance back online after hack, says it will cover 95% of stolen assets

The cyberattack on Binance shook the internet last week. Roughly $6.3 billion worth of assets were stolen from the world's largest crypto exchange, that too within a matter of minutes. But Binance claims to have covered 95 per cent of the losses for its customers.

Last week, Binance, the world's largest crypto exchange, faced a cyberattack. Termed as the biggest cyber incident in history, roughly $6.3 billion worth of cryptocurrency was stolen from the exchange by a group of North Korean hackers. All of which happened in roughly 20 minutes. But the company swung into action shortly after it identified the attack with a global war room of about 100 people. Binance says that it has covered 95 per cent of the lost assets by now.

The company is covering all losses for customers who were impacted by the incident. Binance has 335 million registered users globally. The crypto exchange said that it had covered $6 billion of stolen cryptocurrencies by using company money to buy replacement tokens. As per Binance, the remaining 5 per cent consist of less liquid assets, which may take longer to source in the required amounts.

Before we delve deeper into how Binance's war room countered the incident, we should understand who was likely behind the attack. The FBI attributes the attack to TraderTraitor, a North Korean state-sponsored hacking unit. TraderTraitor, also known as Lazarus, was also behind the Bybit cyberattack last year where it stole $1.5 billion in crypto assets.

Billions lost in minutes

As per a report from Bloomberg, the attack on Binance began a few days prior to the actual incident. At first, the hacker group ran small code sequences through accounts they had on the Ethereum blockchain. But these accounts usually managed small amounts, about a single dollar or two. However, the report adds that the focus of these accounts was to test code that would allow the hackers to gain control of Binance accounts.

On Thursday, about 4 pm New York time (1:30 am IST), the hackers launched the attack. The code gave them access to blockchain accounts owned by Binance, allowing them to empty their wallets even as exchange funds continued replenishing them. The bulk of the theft occurred over about 20 minutes, although funds continued to be drained as the incident became public.

Binance set up a war room

Binance co-founder and co-chief executive Yi He learnt about the incident while scrolling through X at her home in Abu Dhabi. After spotting what had happened, she immediately logged back into work. Yi He found that the exchange's security and wallet teams, which can respond to hacks without executive approval, were already trying to limit the losses.

"Of course, there are areas where we could have done better. We should have invested more in security earlier, and set stricter standards," Yi He said, as quoted by Bloomberg. "Going forward, we won't hold back, whether it's investing in security or fighting hackers."

At first, Binance said it had restored 90 per cent of the stolen tokens before raising the figure to 95 per cent. But the recovered crypto here is not what was stolen. Rather, the company bought about $6 billion in replacement tokens, drawing from its Secure Asset Fund for Users, Futures Insurance Fund and corporate treasury.

Shortly after Binance was able to tackle the situation, the company resumed withdrawals, but in phases. Initially, withdrawals cover 15 tokens, including Bitcoin, Ether, Dogecoin and transactions involving Tether and Circle.

Once withdrawals were back online, Binance customers withdrew assets worth $3.64 billion, equivalent to 2.1 per cent of the exchange's assets. Binance reported $171 billion in assets under management as of October 28.

This marks the biggest cybersecurity incident in history, but it is not the first. Last year, Bybit, another crypto exchange, was targeted by another North Korean hacker group, called Lazarus. Bybit lost crypto assets worth $1.5 billion.