Crypto attacks: Billions lost in Binance and Polymarket hacks
Couldn't have predicted that
Billions of dollars have been drained from wallets on crypto exchange Binance in what is thought to be the world's largest-ever crypto hack, while predictions trader Polymarket is down $2.6 million.
Binance is the world's biggest crypto exchange, where customers can trade digital currencies for other assets.
It appears to have been compromised, at least partially, through a laptop whose owner, an engineer, fell to a social engineering attack.
Binance says its investigations have also uncovered "additional points of breach," but hasn't yet expanded on what those are.
Check Point and TRM Labs have both attributed the attack to a North Korean group, where crypto theft is big business.
Joe Hancock, a partner at Mishcon de Reya and Head of Cyber Risk and Complex Investigations, said North Korea "uses a range of frauds and cyberattacks to gain access to [the] foreign currency it needs to maintain its economy and to fund its various military programmes."
Check Point specifically singled out a unit called TraderTraitor – also known as Lazarus Group.
Lazarus is notorious for high profile attacks on organisations like PyPI and GitHub, as well as multiple crypto hacks. It has also been linked to the previous world record crypto attack: a $1.5 billion theft at the Bybit exchange last year.
What happened?
Binance's co-CEO, Richard Tang, said the hack began with the compromised laptop.
"That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak."
Hancock agrees with Tang's summation: "The hack would require complex knowledge of internal systems and the chaining together of multiple steps. It was likely a technology failure not a blockchain or protocol problem. Multiple currencies, not just Bitcoin, were used."
Major crypto issuers and platforms have frozen assets in response to the attack. The public nature of blockchain technology should make any movement of the funds visible, but recovery will prove challenging.
Because stolen crypto can simply sit in wallets until the heat has passed (although that is unlikely in this case), laundering often takes place over an extended time period - weeks, months or more.
"Assets that can be frozen will be disposed of first, followed by a potential consolidation into Bitcoin and a movement off chain via a range of brokers or underground banking," says Hancock.
Polymarket fails to predict its own hack
Although not on the same scale as the Binance attack, crypto-based predictions market Polymarket was also victim to a hack overnight.
The Wall Street Journal says a blockchain wallet belonging to a suspected attacker appeared to show more than $2.5 million in funds drawn from more than 700 Polymarket user accounts.
The hacker(s) appear to have exploited a flaw in Polymarket's website, which the company traced back to third-party performance-monitoring tool DebugBear.
Polymarket has referred the matter to UK law enforcement, where DebugBear is based. It also briefly paused trading on its international exchange while it responded.
DebugBear has not responded to media requests for comment, but posted on social media yesterday that it had been "impacted by an ongoing security incident." It advised customers to remove its embed code from their websites in response.
Both Binance and Polymarket have promised to cover the losses from their respective attacks. Mishcon de Reya's Hancock says, "This commitment is partly a factor of [Binance's] size and scale but also reflects a desire for crypto currency to be viewed as safe as more traditional fiat assets.
"Western regulators are still likely to view this as evidence the sector has further to go to match fiat banking."