Experts say North Korea may be behind the $6.3 billion cyber attack on Binance

In the second part of Anadolu Agency's (AA) two-part dossier news titled "The Biggest Robbery of the Digital Age", state-sponsored cyber operations and allegations that North Korea was behind the Binance attack were discussed.

In the approximately $6.3 billion cyber attack against Binance, attackers infiltrated the computers of the company's employees through fake job interviews, social engineering methods and malware during months of preparation.

The attackers, who gained access rights by taking advantage of in-house artificial intelligence tools, transferred billions of dollars worth of crypto assets from the company's digital wallets to addresses under their control.

Experts stated that modern cyber attacks generally involve comprehensive intelligence gathering and planning processes rather than individual technical initiatives, and pointed out that North Korea may be behind the attack on Binance.

While the cyber attack in question was recorded as the biggest cryptocurrency theft of the digital age, the USA blamed North Korea for the attack, and North Korea held the USA responsible.

FBI argues that North Korea organized the Binance attack

The US Federal Bureau of Investigation (FBI) accused North Korea of stealing $6.3 billion worth of digital assets from Binance on October 31.

Claiming that the cyber activity in question is linked to the entity known as "TraderTraitor", the FBI called on private organizations in the cryptocurrency industry to block transactions made with TraderTraitor-related addresses.

On the other hand, Kim Yo-jong, sister of North Korean leader Kim Jong-un and head of the General Affairs Department of the Korean Workers' Party, which governs the country, rejected the claim, claiming that the FBI was trying to brand North Korea as a "cyber criminal state".

Kim Yo-jong said in his statement: "When the current US administration took over last year, it announced that it would seize illegally stolen cryptocurrency assets and use them as the state's strategic reserve. Anyone who looks at who will get the allegedly stolen cryptocurrency when it is recovered can get a clue as to who is behind this cyber attack incident." he said.

"North Korea did this"

Ari Redbord, Head of Global Policy and Government Relations at US-based blockchain analysis company TRM Labs, evaluated the cyber attack against Binance to an AA reporter.

"North Korea did this. Cyber ​​theft funds this sanctioned regime and its weapons programs. The hackers who steal launder this money through networks that criminals use every day," Redbord said. shared his opinion.

Pointing out that the trace of the first attack dates back to June, Redbord said, "It took a few days for the theft incident to occur. Each stage was built on the opportunities provided by the previous one. This is how a patient intelligence service works." he said.

"Fake employers, mock interviews, and malicious coding assignments are typical North Korean methods. Researchers have been observing the same tactic repeated for years. This trap works because engineers take the employer's message seriously and view the coding test as part of the job," Redbord said. he said.

Modern cyber attacks involve extensive intelligence gathering and planning processes

Associate Professor, Department of Information Systems, University of Colorado Denver, USA. Dr. Ersin Dinçeli: "The Binance case reveals that modern cyber attacks often involve comprehensive intelligence gathering and meticulous planning processes rather than isolated technical initiatives." he said.

Pointing out that the distinction between state-sponsored cyber operations and cyber crimes aimed at financial gain is becoming increasingly blurred, Dinçelli reminded that the FBI held North Korea responsible for the Binance attack, but Pyongyang denied these allegations.

Dinçelli said, "Traditionally, state-sponsored attacks are primarily associated with espionage and geopolitical targets, while cybercriminals focus on gaining financial gain, but the motivations of these threat actors are increasingly starting to overlap. North Korea provides a particularly striking example in this regard. In this context, state-sponsored cyber operations are reported to be used not only for espionage purposes, but also to steal cryptocurrencies and generate income for the regime." made his assessment.