In late October, the cryptocurrency exchange Binance suffered the largest theft in history, with hackers linked to North Korea stealing over $6 billion from hot wallets. This incident echoed a fictional scenario presented to students at the Atlantic Council’s Monterey Cyber 9/12 Strategy Challenge just a year prior. The exercise simulated a $2 billion heist from a fictional exchange, AuriXchange, involving spear-phishing and North Korean hackers. Several student teams proposed strategies that anticipated real-world responses to the Binance attack, but the actual hack also revealed gaps in their approach, particularly regarding human vulnerabilities.
One key lesson from the students was the importance of quickly freezing stolen funds, though they distinguished between freezing and recovering assets. In the Binance hack, about $2.8 billion was frozen or intercepted within hours, thanks to rapid action by stablecoin issuers Tether and Circle. The students also emphasized the need for formalized cooperation among exchanges, blockchain analytics firms, and financial intelligence units to standardize such responses.
The students were cautious about publicly attributing the hack to North Korea, preferring thorough investigation before making claims. In reality, analytics firms TRM Labs and Chainalysis attributed the Binance hack to TraderTraitor within hours, supported by evidence of commingled funds from previous hacks. The FBI confirmed the attribution two days later, though North Korean officials denied involvement. The students’ caution was partly due to misleading intelligence introduced during the competition, highlighting the challenges of attribution in real-world scenarios.
Another recommendation from the students was to sanction the cash-out networks rather than just the hackers. Since the stolen crypto had not yet been converted to fiat currency, targeting intermediaries and wallets involved in money laundering could disrupt the scheme at its weakest point. The students also suggested legal frameworks to manage frozen assets, as Binance had already replenished 98 percent of the stolen funds from its reserves, leaving questions about the recovery of the remaining frozen assets.