ReportedattributionStatement 789
The Next Web reported that Binance has not named a culprit and that North Korea has denied involvement in hacks in the past.
Binance has not named a culprit. North Korea has denied involvement in hacks in the past
Statements
Each statement is one attributed line with a verbatim quote from a stored copy of the source. Only approved statements are shown.
Official means the party said it, not that it is true.
- Verified on-chain. Reproduced by us from raw chain data kept in our own storage. The method is shown.
- Official. Stated by the party concerned (an exchange, an agency, a token issuer or similar), attributed to them. Official means the party said it, not that it is true.
- Reported. Stated by news media or an analytics firm, attributed to them.
- Disputed. Credible sources conflict. The statement links the sources that disagree.
- Debunked. Contradicted by primary evidence, which is linked.
- Theory. Speculation, attributed to whoever proposed it, shown with the evidence for and against.
390 statements.
ReportedattributionStatement 788
The Next Web reported that TRM said it makes its North Korea judgment with high confidence, based on on-chain and off-chain intelligence.
TRM said it makes its North Korea judgment “with high confidence”, based on on-chain and off-chain intelligence.
ReportedattributionStatement 779
Halborn said Sygnia traced the Bybit loss to a compromised developer workstation, stolen cloud session tokens and a tampered signing interface, called it the same playbook with a different entry, and added that precedent is not evidence.
In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.
ReportedattributionStatement 778
Halborn gave its own view, before any government attribution, that the pattern fits TraderTraitor and that compliance teams should act on it rather than wait for a press release.
My view is that the pattern fits and that a compliance team should act on it today rather than wait for a press release.
ReportedattributionStatement 777
Halborn said Elliptic also lists caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out used market makers and lending rather than bridges, and no government had spoken whereas the FBI attributed Bybit within five days.
Elliptic also lists the caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out went through market makers and lending rather than bridges, and no government has said a word, whereas the FBI attributed Bybit within five days. Binance has named nobody.
ReportedattributionStatement 776
Halborn said Elliptic's further reasons were the preparation pattern seen in Bybit and KelpDAO, the targeting of staff matching the DMM Bitcoin case, and the capability to drain eleven chains in three hours.
the preparation pattern of Tornado Cash funding, rehearsal and pre-signed bursts seen in Bybit and in KelpDAO in April; the targeting of staff, which matches the DMM Bitcoin case; and the capability to drain eleven chains in three hours.
ReportedattributionStatement 775
Halborn said Elliptic rates the attribution as likely and lists a laundering address shared with the September Bitget theft, with only about 39,000 dollars of Binance funds against 510,000 linked to Bitget.
Elliptic says likely, and lists its reasons: a laundering address shared with the September Bitget theft, 0x1510…feb7, although only about 39,000 dollars of Binance funds reached it against 510,000 linked to Bitget;
ReportedattributionStatement 774
Halborn said TRM states high confidence that this is TraderTraitor, on the basis of on-chain and off-chain intelligence TRM has not published.
On attribution, TRM states high confidence that this is TraderTraitor, the North Korean unit the FBI named for Bybit, on the basis of on-chain and off-chain intelligence it has not published.
Reportedroot causeStatement 771
Halborn said the operator wallet was funded from Tornado Cash starting the morning of 28 October, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.
The operator wallet was funded from Tornado Cash starting the morning of October 28, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.
Reportedroot causeStatement 770
Halborn said Bitquery notes the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction, a tie Halborn accepted with that caveat.
Bitquery notes that the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction
Reportedroot causeStatement 769
Halborn offered two readings: either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
Either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
ReportedotherStatement 767
Halborn said that by Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses that nobody can freeze, including 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX.
What the attacker keeps is what nobody can freeze. By Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses: 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX, with about 445 million in XRP, SOL and NEAR that has not moved at all.
ReportedfreezeStatement 764
Halborn said issuers froze about 2.8 billion dollars, most of it within 47 minutes of the main sweep, but that the attacker had moved 700 million USDT out of the hub before the first freeze and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
Reportedroot causeStatement 762
Halborn gave its own reading, "persistence and independence", under which one signature bought unlimited, policy-free control of the largest wallet until someone revoked it.
My reading is persistence and independence. One signature bought unlimited, policy-free control of the largest wallet until someone revoked it, with no further requests through a compromised path that could be cut at any moment.
ReportedamountStatement 761
Halborn said a second Ethereum hot wallet, Binance 16, signed nine ordinary transfers to the attacker worth about $174 million with no delegation involved.
Binance 16, the second Ethereum hot wallet, signed nine ordinary transfers to the attacker worth about $174 million, with no delegation at all.
Reportedroot causeStatement 759
Halborn said the question that decides the root cause is which identity caused which component to authorize which bytes, and why that instruction passed, and that it cannot be answered from outside.
The question that decides the root cause is simple to state and impossible to answer from the outside: which identity caused which component to authorize which bytes, and why did that instruction pass?
Reportedroot causeStatement 758
Halborn said Binance had confirmed the first two boxes of its attack-chain diagram and that the box in between was the one the post-mortem has to explain.
Binance has confirmed the first two boxes, the chain shows the last four, and the dashed box in between is the one the post-mortem has to explain.
Reportedroot causeStatement 757
Halborn said that whether Binance's signing path signs raw digests or accepts EIP-7702 authorizations as a message type is inference, and that only Binance's signer request log can settle it.
So either Binance’s signing path signs raw digests, or it supports 7702 authorizations as a message type and nothing in front of it objected to fifty of them. Both are inference.
Reportedroot causeStatement 756
Halborn said, as its own inference, that fifty pre-signed authorizations suggest someone who could get the key to sign digests but could not control when, how fast or how many times.
An attacker holding the raw key would sign one authorization at submission time. Fifty pre-signed ones suggest someone who could get the key to sign digests but could not control when, how fast, or how many times.
Reportedroot causeStatement 755
Halborn said nine other chains lost funds through correctly signed transfers, which it called the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.
Nine other chains lost money through nothing more exotic than correctly signed transfers, and that is the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.
Reportedroot causeStatement 754
Halborn said nothing public establishes how the laptop was infected, how long the attacker had access, the operating system or the malware.
Nothing public establishes the infection method, the dwell time, the operating system or the malware.
Reportedroot causeStatement 753
Halborn listed five candidate paths from the container to accepted withdrawals, without saying which was used.
The candidate paths are misuse of that service identity, modification of withdrawal requests in flight, deployment of altered code under a stronger identity, manipulation of policy or approvals, or direct access to a signing interface.
Reportedroot causeStatement 752
Halborn said how access to a container became accepted financial instructions was the link nobody had explained.
Link two is the one nobody has explained: how access to a container became accepted financial instructions.
Reportedroot causeStatement 751
Halborn said the only link in the attack chain Binance had confirmed so far was the first one, and that everything between the laptop and the signatures was still inference.
and the only link Binance has confirmed so far is the first one. Everything between the laptop and the signatures is still inference
ReportedcomparisonStatement 457
Wikipedia says that in March 2022 hackers compromised the Ronin Network and stole approximately US$620 million worth of cryptocurrency.
In March 2022, hackers compromised the Ronin Network, stealing approximately US$620 million worth of cryptocurrency from the project.
Quoted from Wikipedia, available under CC BY-SA 4.0.