API keys and 2FA codes along with other sensitive data has also been stolen.
Binance, one of the largest cryptocurrency exchanges in the world by volume, has become a victim of a massive data breach in which hackers stole roughly 7,000 bitcoin (worth over $40 million).
See: Bitcoin Price Drops 10% Amid Binance Exchange Hacking Rumors
According to Binance, the hackers not only stole API keys but 2FA codes along with other sensitive data after hackers attacked its hot wallet. A hot wallet is used for transactions processing and contained nearly 2% of the exchange’s total holdings.
In its official statement, Binance noted that the hackers used various techniques to compromise the security of their hot wallet. They used techniques like “phishing, viruses, and other attacks,” the company wrote.
Binance also mentioned that it was still researching over the “possible methods used” and there might be other unidentified affected accounts. CEO of Binance Zhao Changpeng wrote that:
“The hackers had the patience to wait, and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time.”
Regarding the losses incurred, the company claims that it will be covering them in full through its insurance reserve called Secure Asset Fund for Users. The reserve was created to counter similar situations.
Binance revealed that an alarm was triggered by its systems while the attack was underway but the company couldn’t timely mitigate it.
“It was unfortunate that we were not able to block this withdrawal before it was executed.”
Furthermore, the company claimed that a complete security analysis and a temporary halt to all the withdrawals and deposits might take a week. “We must conduct a thorough security review. The security review will include all parts of our systems and data,” notes Binance.
The stolen cryptocurrency was traced to a single hot wallet while all the other wallets are “secure and unharmed.” However, until the investigation is done, all the withdrawals and deposits, states Changpeng, will stay suspended while trading will be open.
See: $250k bounty for anyone exposing hackers behind Binance attempted attack
Binance is also collaborating with other exchanges for blocking deposits from hacked accounts in order to ensure that every trace of hackers is completely eradicated from all of its accounts and data, which will be a time-consuming process.
Nevertheless, Changpeng has urged Binance users to immediately change their 2FA codes and API keys to remain unaffected from the aftereffects of the data breach.
According to temtum founder and senior cryptography advisor, Richard Dennis MSc: “While it appears the hack did not attack Binance core systems directly, the fact a phishing attack obtained data such as API code and 2fa keys, suggests this was an ongoing and skilled attack.
“Binance’s power is so significant within the industry that as a result a serious conversation took place in regard to re-organizing the blockchain for only $40 million worth of BTC, while other attacks such as the mt gox attack, which lost $100’s of millions, never attempted this via the Bitcoin core developers, as far as we’re aware.”
“This goes to show the power and influence of certain individuals and organizations within crypto, CZ and a handful of Bitcoin devs. If this roll-back, essentially the same as a 51% attack, was seriously discussed at any point between Binance and Bitcoin developers, then this is a very serious course of action that should now be investigated by all of us involved in the industry, to ensure the integrity from those with authority,” explain Dennis.
“Users frown upon centralized networks and exchanges, but have recently applauded multiple platforms for the delisting of Bitcoin SV and now with the possibility of a reorg mentioned by CZ. I believe that if this was a larger attack, that Binance could not cover financially, a reorg would have been conducted without community or Bitcoin user approval.”
“This shows how centralized Bitcoin, exchanges and all cryptocurrencies really are and how no cryptocurrency at the moment can currently stop these potential issues from arising. It’s the responsibility of all of us, to deliver highly secure solutions and deploy networks in the right way to achieve genuine decentralization sooner rather than later – but not at the risk of the currencies long term suitability as financial products, as we’re seeing with Bitcoin,” said Dennis.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.
