Binance Hack Steals $41 Million From 'Hot Wallet'

Cryptocurrency exchange Binance lost $41 million after attackers compromised its “hot wallet” to grab more than 7000 bitcoin.

On Tuesday, May 7, Binance, the world’s largest cryptocurrency exchange, announced that malicious actors had compromised user application programming interface (API) keys and two-factor authentication (2FA) codes, enabling them to access the company’s hot wallet and steal more than 7,000 bitcoin (BTC). According to Coindesk, this resulted in the immediate suspension of all withdrawals and deposits, and Binance pledged to cover all customer losses using its emergency fund.

Along with immediate concerns the surrounding the Binance hack, this hot wallet heist has stoked the fire on another conversation: bitcoin rollbacks.

Behind the Binance Hack

Cryptocurrency thefts have already topped 1.2 billion this year as hackers ramp up targeted attacks on high-value exchanges like Binance. According to the company’s official statement, “The hackers had the patience to wait, and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time.”

Using 44 individual transactions bundled together — likely designed to mimic typical exchange behavior — the attackers were able to withdraw 7,000 BTC. The withdrawal itself triggered security alarms, but Binance was unable to stop the transaction.

The firm noted that only 2 percent of its total bitcoin value was stolen, and all BTC in their offline “cold wallets” remains secure, but the incident has spurred debate about finding and redistributing the missing funds.

According to CCN, the stolen currency is now stored in seven anonymous wallets, prompting speculation about a blockchain reorganization or rollback. While theoretically possible, such a reorganization would undermine the uncensored, supply-capped nature of bitcoin and cause significant repercussions for the market at large. Fortunately, Binance didn’t suggest the idea and has no plans to initiate a rollback.

How Can Companies Protect Cryptocurrency Wallets?

Beyond breaking the blockchain network, how can companies reduce the risk of cryptocurrency hacks? First, it’s critical to deploy discrete security measures — such as 2FA and anomalous transaction detection — that are capable of blocking most attacks before they reach bitcoin wallets. Binance CEO Changpeng Zhao noted that “significant changes” are coming to its API, 2FA and withdrawal validation processes before the company resumes bitcoin business as usual.

Security experts also highlight the increasing need for a holistic security approach that includes test-driven development, standardized defensive techniques and improved regulation. As the Binance hack demonstrates, even small cracks in crypto security can break the bitcoin vault wide open for attackers.

Douglas Bonderud

Freelance Writer

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Pentesting vs. Pentesting as a Service: Which is better?

5 min read - In today's quickly evolving cybersecurity landscape, organizations constantly seek the most effective ways to secure their digital assets. Penetration testing (pentesting) has emerged as a leading solution for identifying potential system vulnerabilities while closing security gaps that can lead to an attack. At the same time, a newer entrant into the security arena is Pentesting as a Service (PTaaS). Although PTaaS shares some similarities with pentesting, distinct differences make them two separate solutions. This article will discuss how these methodologies…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Behind the Binance Hack

How Can Companies Protect Cryptocurrency Wallets?

More from

Unified endpoint management for purpose-based devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

Operationalize cyber risk quantification for smart security

Pentesting vs. Pentesting as a Service: Which is better?

Topic updates