Dunyodagi eng yirik kriptovalyuta birjasi Binance tarixdagi eng katta kripto o'g'irligiga uchradi va blokcheyn razvedka firmalari Shimoliy Koreya davlat homiyligidagi xakerlar ehtimoliy aybdorlar ekanligini aytishmoqda.
Binance zararni taxminan 6,3 milliard dollar deb baholadi. Har bir o'tkazmani zanjirda kuzatgan TRM Labs 29-oktabrda Binance hamyonlaridan o'n blokcheyn bo'ylab taxminan 6,36 milliard dollar o'g'irlanganini hisoblab chiqdi. Pulning aksariyati taxminan 20 daqiqa ichida chiqib ketdi.
Bu o'g'irlik 2025-yil fevralida Bybit'dan olingan 1,5 milliard dollardan ancha katta bo'lib, avvalgi rekordni yangiladi. Binance yechib olishni to'xtatdi va kompaniya mablag'lari hamda Foydalanuvchilar uchun Xavfsiz Aktivlar Fondi (SAFU) yordamida barcha yo'qotishlarni qoplashga va'da berdi.
Birjaning dastlabki xulosalariga ko'ra, hujum xodimning noutbuki orqali boshlanishi mumkin.
"Binance'ning dastlabki tekshiruvi shuni ko'rsatadiki, xavfsizlik hodisasi DevOps muhandisining noutbuki buzilishi bilan bog'liq bo'lishi mumkin, bu esa hujumchiga xizmat konteyneriga kirish va ruxsatsiz yechib olish tranzaksiyalarini yuborish imkonini bergan. Biz hamyon shaxsiy kalitlari sizib chiqqaniga oid hech qanday dalil topmadik", — deb bayonot berdi Binance.
TRM tahlili shuni ko'rsatadiki, hujumchilar kamida bir yarim kun tayyorgarlik ko'rishgan. Operatsiyani boshqarish uchun ishlatilgan hamyon bir nechta kichik Tornado Cash yechib olishlari bilan moliyalashtirilgan va zararli kod boshqa hamyonlarda sinovdan o'tkazilgan.
Ethereum'da hujumchilar EIP-7702 mexanizmidan foydalangan, bu orqali standart hamyon o'z xatti-harakatini ruxsatni imzolash orqali aqlli shartnomaga topshirishi mumkin. Ular 50 ta shunday ruxsat yuborishgan, barchasi Binance issiq hamyoni tomonidan oldindan imzolangan, shuning uchun biri bajarilish vaqtida hamyonning tranzaksiya soniga mos kelgan.
Binance hamyoni faqat hujumchilar boshqarishi mumkin bo'lgan shartnomaga topshirilgan va ular uni bo'shatishgan.
TRM ma'lumotiga ko'ra, Ethereum'dagi faoliyat dastlab fishing natijasi kabi ko'ringan. Bu nazariya boshqa to'qqiz blokcheynni tushuntirmaydi, u yerda Binance hamyonlari hujumchilarga odatiy, to'g'ri imzolangan tranzaksiyalar orqali mablag' yuborgan.
"Bu hamyonlar turli zanjirlar, kalit turlari va imzolash sxemalaridan foydalanadi. Ularning barchasi taxminan yarim soat ichida hujumchi uchun to'g'ri imzolarni yaratgan. TRM bahosiga ko'ra, eng ehtimoliy tushuntirish — hujumchi Binance'ning issiq hamyon imzolash tizimini o'z tanlagan tranzaksiyalarini zanjirlar bo'ylab imzolashga majbur qilish qobiliyatiga ega bo'lgan", — dedi TRM.
Tadqiqotchilar Shimoliy Koreyaga ishora qilishmoqda
"TRM bu hujumni TraderTraitor — Shimoliy Koreyaning elita xakerlik bo'linmasiga — mustahkam zanjir ichidagi va tashqarisidagi razvedka asosida bog'laydi. Biz bu xulosani yuqori ishonch bilan qilamiz", — dedi blokcheyn razvedka firmasi.
TRM bu hujum Bybit o'g'irligi va 2026-yil aprelidagi KelpDAO xakerligi bilan umumiy xususiyatlarga ega ekanligini aniqladi. Bular orasida mikser bilan moliyalashtirilgan operator hamyoni, pul harakatlanishidan ancha oldin tayyorgarlik ko'rish va oldindan to'plangan imzolarni birdaniga ishlatish bor.
Hozirgacha ko'rilgan yuvish bu operatsiyani ajratib turadi. Bybit holatida zanjirlararo ko'priklarga tayanish o'rniga, xakerlar asosan bozor yaratuvchilari bilan yirik savdolar va kredit platformalariga tayanishgan.
Chainalysis bosh direktori Jonatan Levin o'z kompaniyasi ham TraderTraitor ehtimoliy aybdor deb hisoblashini aytdi va avvalgi xakerlik bilan bog'liqlikni keltirdi. Chainalysis tergovchilari o'tgan oydagi Bitget ekspluatatsiyasidan olingan mablag'lar Binance'dan olingan mablag'lar bilan aralashganini aniqlashdi.
Blokcheyn izlovchisi ZachXBT ham Lazarus Group'ni ehtimoliy hujumchi deb nomladi.
FBI Bybit o'g'irligini TraderTraitor'ga bog'ladi. Binance xakerlarni ommaviy ravishda aniqlamagan va ular kimligini aniqlash uchun huquqni muhofaza qilish organlari bilan hamkorlik qilayotganini aytgan.
Milliardlar muzlatildi, milliardlar hali ham harakatlanishi mumkin
Stabilkoin emitentlari tez harakat qilishdi. 30-oktabr UTC 00:30 ga qadar TRM taxminan 2,7 milliard dollar muzlatilgan aktivlarni sanadi, jumladan Tether tomonidan muzlatilgan taxminan 1,77 milliard USDT va Circle tomonidan muzlatilgan taxminan 825 million USDC.
Ripple va World Liberty Financial kichikroq miqdorlarni muzlatdi va Arbitrum Xavfsizlik Kengashi favqulodda vakolatlaridan foydalanib hujumchi hamyonidan taxminan 30 million dollarni ko'chirdi. Binance muzlatilgan umumiy miqdorni taxminan 3 milliard dollar deb baholadi.
Emitentlardan oldinda qolish uchun hujumchilar USDT'ni ETH'ga bozor narxidan 10% dan ortiq past narxda sotishdi. TRM ma'lumotiga ko'ra, ular hali ham 420 000 dan ortiq ETH va 18 270 BTC, ya'ni taxminan 2,4 milliard dollar aktivlarga ega — bu emitentlar muzlata olmaydigan mablag'lar.
Bog'liq: Ledger Signer apparat implantatsiyasi bilan bog'liq 86 million dollarlik kripto o'g'irligi
Bog'liq: Kripto firibgarlar Microsoft'ning rasmiy X akkauntini egallab olishdi
Bog'liq: Shimoliy Koreya 351 million dollarlik Bitget kripto o'g'irligida gumon qilinmoqda
Binance, the world’s largest cryptocurrency exchange, has been hit by the biggest crypto heist ever recorded, and blockchain intelligence firms say North Korean state-sponsored hackers are the likely culprits.
Binance has put the damage at roughly $6.3 billion. TRM Labs, which followed each transfer on-chain, calculated about $6.36 billion siphoned from Binance wallets across ten blockchains on October 29. Most of the money left within roughly 20 minutes.
The haul dwarfs the $1.5 billion taken from Bybit in February 2025, which previously held the record. Binance has halted withdrawals and pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
The exchange’s early findings suggest the intrusion may have started with an employee’s laptop.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak,” Binance stated.
TRM’s analysis shows the attackers spent at least a day and a half getting ready. The wallet used to run the operation was funded with a few small Tornado Cash withdrawals, and the malicious code was trialed on other wallets before going live.
On Ethereum, the attackers leveraged EIP-7702, a mechanism through which a standard wallet can delegate its behavior to a smart contract by signing a permission. They sent a batch of 50 such permissions, all signed beforehand by a Binance hot wallet, so that one would match the wallet’s transaction count at execution time.
The Binance wallet ended up delegated to a contract that only the attackers could command, which they used to empty it.
According to TRM, the Ethereum activity initially looked like the result of phishing. That theory does not account for the other nine blockchains, where Binance wallets sent funds to the attackers through regular, validly signed transactions.
“These wallets use different chains, key types and signing schemes. All of them produced valid signatures for the attacker within about half an hour. In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains,” TRM said.
Researchers point to North Korea
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the blockchain intelligence firm said.
TRM found traits this attack shares with the Bybit heist and the KelpDAO hack from April 2026. These include a mixer-funded operator wallet, preparations made long before any money moved, and signatures collected ahead of time and then used all at once.
The laundering seen so far sets this operation apart. Instead of leaning on cross-chain bridges as in the Bybit case, the hackers have mainly relied on big trades with market makers and on lending platforms.
Chainalysis CEO Jonathan Levin said his company also believes TraderTraitor is the likely perpetrator, citing ties to an earlier hack. Chainalysis investigators found proceeds from last month’s Bitget exploit mixed with funds taken from Binance.
Blockchain sleuth ZachXBT also named the Lazarus Group as the probable attacker.
The FBI attributed the Bybit theft to TraderTraitor. Binance has not publicly identified the hackers, saying it is cooperating with law enforcement to determine who they are.
Billions frozen, billions still movable
Stablecoin issuers were quick to act. By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
Ripple and World Liberty Financial froze smaller amounts, and Arbitrum’s Security Council used its emergency powers to move about $30 million out of an attacker wallet. Binance estimates the frozen total at roughly $3 billion.
To stay ahead of the issuers, the attackers sold USDT for ETH at more than 10% below market price. TRM says they still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze.
Related: $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Related: Crypto Scammers Hijack Microsoft’s Official X Account
Related: North Korea Suspected in $351 Million Bitget Crypto Heist
