In a significant security breach, a wallet associated with the renowned exchange Binance has fallen victim to a hack, resulting in the loss of $27 million, primarily in Tether (USDT). The breach was uncovered by the reputable on-chain investigator ZachXBT.
Details of the Cyberattack Unveiled
ZachXBT‘s analysis reveals that the breach occurred on November 11, leading to the swift conversion of stolen funds from USDT to Ethereum (ETH). The hackers utilized various services, including FixedFloat and ChangeNow, to obfuscate the trail of the stolen assets. The final phase involved converting these assets to Bitcoin through THORChain, a decentralized liquidity protocol.
It appears someone had 27M USDT stolen yesterday.
0x0f2183c8e415e61b4ad7774bf1097019eb2d5b85798a2a229070495131d60321
USDT was quickly swapped for ETH, then transferred to a number of services (FixedFloat, ChangeNow, etc), and bridged to Bitcoin via THORChain. pic.twitter.com/SgEBwyZZSc
— ZachXBT (@zachxbt) November 12, 2023
Adding a layer of intrigue to the incident, the compromised wallet had received the funds through a withdrawal from Binance just a week before the heist. Further investigation by ZachXBT unveiled that in May 2019, the same wallet received funds from an address associated with Etherscan as a Binance smart contract deployer.
Record Losses in Q3 2023 Web3 Security Breaches
The incident contributed to a turbulent quarter for crypto security, as highlighted in Certik‘s Web3 Security Quarterly report for Q3 2023. The report reveals a staggering $699 million in losses across 184 security incidents, surpassing the combined losses of the previous two quarters. Notably, the Lazarus Group, a North Korean state-affiliated threat actor, played a significant role in these losses, employing sophisticated tactics and focusing on Web3 personnel through social engineering.
The report identifies private key compromises as a significant factor in this quarter’s losses, accounting for $204 million across 14 incidents. Incidents involving Mixin and Multichain alone resulted in $325 million in losses, emphasizing the vulnerability of key security components in the evolving landscape of cryptocurrency threats.
