Kathmandu. The world’s largest cryptocurrency exchange, Binance, has suffered the biggest cyber attack in history. A preliminary investigation shows that hackers have stolen cryptocurrency worth about 6.3 billion US dollars from Binance’s digital wallet. It is suspected that the North Korean government-backed hacker group is involved in this incident.
TRM Labs and Chainalysis, two major blockchain analysis organizations, have concluded with high confidence that the North Korean hacker group ‘Lazarus Group’, i.e. ‘TraderTraitor’, is involved in this attack. However, Binance said that the investigation is ongoing to confirm the identity of the attacker.
According to TRM Labs, the hackers took out digital assets worth about 6.36 billion dollars from wallets in 10 different blockchains of Binance. Most of it was transferred within about 20 minutes.
In the initial investigation, it was suspected that unauthorized access to the system was made by hacking the laptop of an engineer of Binance. However, the company’s co-chief executive officer, Richard Teng, said that during further investigation, other weaknesses in security and additional points of attack were found.
It is suspected that hackers have gained access to the security system of the ‘hot wallet’ connected to the Internet. Analysts say that an arrangement may have been made for the money from the wallet to be automatically transferred to the control of the attacker by using special permission.
After the incident, Binance has promised to bear all the damage to the customer’s property. The company has set aside 6.34 billion dollars to compensate for the stolen amount. Additionally, in collaboration with other blockchain partners, it has been able to freeze approximately $3 billion of affected assets.
According to Binance, about 80 percent of the stolen property has been recovered. The remaining amount has not been found yet. Analysts have said that attempts are being made to hide the stolen cryptocurrency by converting it into other digital assets including Bitcoin.
US President Donald Trump has also said that US authorities are investigating the incident. When asked about the involvement of North Korea, he responded that it is being investigated.
North Korean hackers have been involved in major cryptocurrency thefts before. Last year, the US Federal Bureau of Investigation (FBI) held North Korea responsible for the theft of approximately $1.5 billion from Dubai-based cryptocurrency exchange Bybit. Also in 2022, North Korean hackers were suspected of stealing cryptocurrency worth about 620 million dollars.
It is alleged that North Korea has been using cryptocurrency theft as a means of earning foreign currency since 2017. A group of experts who submitted a report to the United Nations Security Council reviewed 58 suspected cyber attacks related to North Korea from 2017 to 2023. Around $3 billion worth of cryptocurrency was estimated to have been stolen from those attacks.
According to the report, proceeds from cryptocurrency theft are estimated to account for nearly half of North Korea’s total foreign exchange earnings. Another country estimates that up to 40 percent of the stolen funds are used for weapons of mass destruction programs.
North Korean leader Kim Jong Un is estimated to have about 50 nuclear weapons under his control. North Korea, which is providing military and weapons support to Russia in the Russia-Ukraine war, is itself economically weak. Citing United Nations data, it is mentioned in the public report that 40 percent of the population there is affected by malnutrition and about one in five children have stunted physical development.
In the midst of such an economic situation, North Korea has been accused of systematic cybercrime in order to raise the necessary funds to carry out military and nuclear programs.
According to Ciaran Martin, the former head of the UK’s National Cyber Security Centre, the main reason why North Korea is targeting the cryptocurrency sector is its relatively weak security system. Traditional banks have developed strong security systems to avoid cyber attacks. However, according to his analysis, it is easy to take advantage of security weaknesses in the rapidly expanding and relatively less regulated cryptocurrency sector.
The activities of North Korean hackers are not limited to cryptocurrencies. It is also alleged that they were involved in the cyber attack on the Central Bank of Bangladesh in 2016. Hackers tried to illegally transfer 951.1 million dollars from Bangladesh Bank’s account at Federal Reserve Bank of New York. However, even though most of the transactions were stopped, 80 million dollars were stolen.
Similarly, North Korea has been accused of producing fake US dollars in the 1990s and raising foreign currency through drug production and smuggling in the 2000s.
Another feature of North Korea is that there is very limited internet access for the general public. However, mathematics and science are given priority from the school level. It is mentioned in various reports that students who perform best in the university will be selected and recruited into a special hacker group. Such groups are said to operate under North Korea’s intelligence agency ‘Reconnaissance General Bureau’.
The activities of the North Korean hacker group “Lazarus” came to international attention after the cyber attack on Hollywood’s Sony Pictures in 2014. At that time, Sony invested in the production of the movie ‘The Interview’ based on the story of the assassination of North Korean leader Kim Jong Un. After that, thousands of secret emails of the company were made public. It was alleged that the Lazarus group was involved in the attack.
North Korea has been denying its government’s involvement in cybercrime. However, in the midst of international sanctions and economic crisis, he has been accused of using cybercrime and theft of digital assets as a means of income to raise foreign currency.
Analysts have also pointed out the possibility that AI may have been used in the latest attack. The method used to hide the stolen money is different and complicated from previous cases. After this incident, the cryptocurrency market has also been affected. After the news of the attack became public, the price of Bitcoin fell by about 5 percent to 77 thousand 380 dollars.