North Korea Tied to Binance Hack in Tactics Echoing Bybit Breach

North Korean hackers have been identified as being behind the large-scale hack of Binance, the world’s largest digital-asset exchange.

According to CNN on Oct. 30, blockchain analytics firm TRM Labs concluded that a North Korean hacking group was involved after analyzing on-chain and off-chain data.

TRM Labs said it detected small fund transfers through Tornado Cash before the attack. It also found that the hackers used pre-obtained signatures to steal assets in a short period, a pattern seen in past hacks linked to North Korea.

The firm added that the same method was used in the Bybit hack in February last year and the KelpDAO hack in April this year. Based on a combined review of on-chain and off-chain data, it said it had high confidence that the attack was carried out by the North Korean hacking group TraderTraitor.

Other analytics firms reached similar conclusions. Singapore-based Pangolin Intelligence said its comparison of on-chain transactions tied to the latest hack with previous incidents involving North Korean hacking groups pointed to North Korea as the likely culprit.

Chainalysis also said North Korea was likely behind the attack. The firm is tracking the stolen funds as they move across multiple blockchains, including Bitcoin and Ethereum.

The hack is believed to have started after a Binance engineer’s laptop was compromised. The hackers then appear to have accessed internal services and executed unauthorized withdrawal transactions.

Losses from the hack are currently estimated at about $6.36 billion.