Dr Wiehann Olivier, Partner and Global Co-Head of Digital Assets, Forvis Mazars

Now that the dust is settling around the Binance hack, we can start to make sense of what happened. And the story is more revealing than the headline that $6.4 billion of cryptocurrency was stolen.

The blockchains were not hacked. Billions in stolen assets were subsequently frozen. Much of the remaining money can be watched moving across public ledgers. And investigators believe the attack ultimately raises money for North Korea.

Understanding how all four can be true tells us a great deal about how crypto actually works.

On 29 October, attackers moved approximately $6.4 billion in digital assets out of Binance’s hot wallets (the internet-connected wallets exchanges use for day-to-day withdrawals) across multiple blockchains. Blockchain analytics firm Chainalysis describes it as the largest cryptocurrency theft on record.

At face value, this seems to reinforce a familiar concern: if billions in cryptocurrency can disappear in minutes, how secure is blockchain technology?

The blockchains were not hacked

On Ethereum, Chainalysis reports that the attacker used valid signed authorisations that allowed a Binance hot wallet to run code the attacker had deployed. Other compromised wallets appeared to make ordinary signed transfers. The underlying blockchains kept operating exactly according to their rules.

In simple terms, this was closer to getting hold of someone’s internet banking login than breaking the banking system itself.

It follows a pattern we’ve seen in attacks on traditional finance, such as the 2016 Bangladesh Bank heist and the Carbanak bank-hacking campaign: weaknesses in institutions and their systems can be exploited without compromising the underlying financial network.

Who was behind it?

The FBI has attributed the theft to North Korea, naming the hacking group it calls TraderTraitor.

Attribution isn’t based on a single transaction. Investigators analyse wallet connections, transaction patterns, laundering behaviour and links to previous attacks. One significant clue was that Binance funds became mixed on-chain with funds from an earlier theft already attributed to North Korea.

This isn’t simply financially motivated cybercrime. North Korea’s cyber operations are believed to generate revenue for the regime, including its weapons programmes. The Multilateral Sanctions Monitoring Team says these activities support North Korea’s unlawful weapons of mass destruction and ballistic missile programmes.

So how does stolen cryptocurrency become usable money?

Stolen, but visible

This is where we encounter one of crypto’s great contradictions.

Transactions on public blockchains such as Bitcoin and Ethereum are visible to anyone. Once investigators identify an address linked to stolen assets, they can follow the money as it moves. The FBI has even published addresses associated with the Binance theft.

That transparency gives investigators an unusual advantage. Had the funds moved through traditional banking rails, tracing them across banks and jurisdictions would normally mean requesting information from each institution involved. On a public blockchain, much of that movement is recorded on a shared ledger and can be watched as it happens.

The challenge is therefore often not seeing where the money went, but establishing who controls the addresses and who eventually converts the assets into something usable.

Visibility, however, doesn’t mean the money can be stopped.

Nobody centrally controls bitcoin or ether. Dollar-backed stablecoins such as USDT and USDC are different, because their issuers can freeze specific addresses.

That distinction proved important. By 3 November, approximately $2.8 billion had been frozen. At the same time, the attacker was racing to convert freezable stablecoins into ether, an asset with no central issuer able to freeze it.

Following the money

This raises perhaps the most interesting question: if regulated exchanges apply strict know-your-customer (KYC) and anti-money-laundering checks, how does North Korea turn stolen crypto into money it can actually use?

The answer is that the funds don’t necessarily go straight from a hacker’s wallet into a major regulated exchange.

Previous North Korean thefts show funds moving through wallets, blockchains, bridges, mixers and privacy tools before reaching intermediaries and over-the-counter (OTC) brokers. The aim is to put distance between the theft and the eventual cash-out. Chainalysis has documented North Korean-linked funds flowing through Hong Kong intermediaries and Russian and Cambodian laundering networks, with Chinese-issued UnionPay cards also identified as a way to access cash.

An intermediary can receive crypto on one side and provide cash, payment access, goods or other value on the other. The crypto never needs to land in a regulated exchange account bearing North Korea’s name.

But there’s a catch: moving the crypto doesn’t erase its history. Public blockchains leave a permanent transaction trail.

The paradox at the heart of crypto

The Binance incident therefore exposes a paradox that is often misunderstood.

Gaining control of digital assets can make the money exceptionally difficult to recover. But moving that money without leaving a trail can be exceptionally difficult too.

Unlike with traditional financial rails, investigators don’t necessarily need to ask a string of institutions where the money went. Much of that journey is already visible.

The real challenge is identifying who controls the wallets, where the funds eventually leave the blockchain, and who is prepared to convert them into something the North Korean regime can actually use.

That’s where the next phase of this $6.4 billion investigation will be fought.

Ed’s note: Read ICTS Legal’s publication “What the Hack” sharing cybersecurity learnings here.

ENDS