The $6.3B Binance hack was pulled off in just 20 minutes

“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”

Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins.

The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.

Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers.

“We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED.

“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says.

“The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says.