Worked example · 2019-05
Binance hot-wallet compromise — Bitcoin — 2019-05-07
Summary
Binance was (and remains) the world's largest cryptocurrency exchange by reported volume. In May 2019, Binance maintained a Bitcoin hot wallet containing a material portion of exchange reserves for withdrawal processing. The hot wallet was secured by Binance's internal operational security infrastructure, including multi-signature signing, withdrawal limits, and API-key-based authentication.
On 2019-05-07, attackers gained access to Binance's hot-wallet signing infrastructure through a coordinated attack sequence:
- Phishing campaign: Binance employees were targeted with spear-phishing emails harvesting credentials for internal systems.
- Credential harvesting: The attackers obtained API keys, two-factor authentication tokens, and internal-system credentials from multiple Binance employees.
- 2FA bypass: The attackers bypassed Binance's 2FA implementation (likely via real-time phishing relay or SIM-swap on employee accounts — the exact 2FA-bypass mechanism was not publicly detailed).
- Hot-wallet drain: Using the compromised credentials and API keys, the attackers authorized a single transaction transferring 7,074 BTC from Binance's Bitcoin hot wallet to addresses under attacker control.
- Laundering: The stolen BTC was split across multiple wallets and routed through coinjoin and mixer services.
Binance detected the unauthorized withdrawal within minutes, suspended all deposits and withdrawals for approximately one week (May 7-14), and initiated an internal investigation. CEO Changpeng Zhao publicly disclosed the incident on May 7 via Twitter and a Binance blog post. Binance announced that the loss would be covered by SAFU, the exchange's insurance fund (funded by 10% of trading fee revenue), and that no users would lose funds.
The UN Panel of Experts on DPRK sanctions subsequently attributed the attack to DPRK cyber-operations in their 2020 annual report, citing the methodology overlap with the broader DPRK exchange-compromise campaign.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| pre-2019-05-07 | Binance operates Bitcoin hot wallet; employees targeted with spear-phishing campaign harvesting credentials, API keys, and 2FA tokens | T15.003 (phishing + credential harvesting) |
| 2019-05-07 ~08:00 | Attackers use compromised credentials + 2FA bypass to access Binance's hot-wallet signing infrastructure; authorize single withdrawal of 7,074 BTC | T11.001 (signing-infrastructure compromise) |
| 2019-05-07 T+minutes | Binance detects unauthorized withdrawal; suspends all deposits and withdrawals; CZ publicly discloses via Twitter | (incident response) |
| 2019-05-07 T+hours | Stolen BTC split across multiple wallets; routing through coinjoin / mixer services begins | T7.001 (mixer-routed laundering) |
| 2019-05-07 to 2019-05-14 | Binance conducts internal security review; withdrawals remain suspended; SAFU coverage announced | (remediation) |
| 2019-05-14 | Withdrawals resume; Binance completes post-incident security upgrades | (recovery) |
| 2020 | UN Panel of Experts on DPRK sanctions attributes Binance 2019 hack to DPRK cyber-operations | (attribution record) |
| 2019-2025 | The Binance-2019 pattern repeats across the DPRK exchange-compromise campaign: KuCoin 2020, Liquid 2021, Crypto.com 2022, Poloniex 2023, DMM Bitcoin 2024, WazirX 2024, BingX 2024, Phemex 2025, Bybit 2025 | (campaign continuity — T8.001 / G01) |
Realised extraction
Approximately $40M (7,074 BTC). Binance covered the full loss through SAFU. Recovery was minimal; the stolen BTC was laundered through mixer services and never recovered.
Public references
- Binance, "Binance Security Breach Update," May 7, 2019 (official blog post)
- Changpeng Zhao (@cz_binance), Twitter thread, May 7, 2019
- UN Panel of Experts on DPRK Sanctions, 2020 Annual Report (attribution section)
- Chainalysis / Elliptic / CipherTrace incident reports (May 2019)
- US Treasury / OFAC subsequent DPRK exchange-compromise designations