{"text":[[{"start":11.12,"text":"The largest financial theft in history took no more than 30 minutes."}],[{"start":15.76,"text":"Just after 8pm London time on Thursday, five cryptocurrency wallets controlled by Binance, the world’s largest exchange, were suddenly drained of roughly $300mn in crypto tokens. Over the next half-hour, the attacker repeated the trick several times, stealing an eye-watering $6.3bn in bitcoin, ethereum and other cryptocurrencies."}],[{"start":38,"text":"As Binance raced to stem the bleeding, crypto companies froze what assets they could. Still, within a few hours, the hackers controlled at least $3.33bn, according to analysis by Elliptic, a blockchain analytics company — making the hack by far the biggest robbery of all time."}],[{"start":56.56,"text":"“This is huge by almost any metric,” said Eswar Prasad, economics professor at Cornell University."}],[{"start":62.32,"text":"The size and speed of the theft has left Binance, its customers and even the most ardent crypto enthusiasts asking how such a breach could happen at the world’s biggest digital assets exchange."}],[{"start":73.354,"text":"Richard Teng, co-chief executive of Binance, laid bare the scale of the hack on Friday, saying the company was rebuilding and retesting its “entire infrastructure system” and “conducting a full security review across the entire company”."}],[{"start":88.72,"text":"Binance, the FBI and blockchain analysis companies are racing to trace the funds and try to stop them being cashed out."}],[{"start":94.24,"text":"The theft is the latest and largest in a wave of heists that highlight the threat hackers pose to crypto exchanges and the capabilities of North Korea’s powerful state-backed hacking industry, which is thought to have been behind the attack."}],[{"start":107.019,"text":"“The scale is what is challenging here,” said Phil Larratt, senior director of global services at Chainalysis, a blockchain tracing firm which is working with Binance. The hacker was “state-sponsored” and “extremely sophisticated”, he added."}],[{"start":120.08,"text":"The day before the heist, the hacker began practising, first by sending three small crypto payments into an online wallet via Tornado Cash, a service designed to obscure where crypto comes from. Then, about four hours before the attack, the hacker tested the malware used against Binance on two other crypto wallets, Elliptic said."}],[{"start":140.566,"text":"Exactly how the hacker accessed the wallets is unclear. Binance’s initial investigation suggested the attacker first compromised the laptop of one of its software engineers and then submitted “unauthorised withdrawal transactions”."}],[{"start":154,"text":"Engineers’ laptops are attractive targets for hackers because such staff often have privileged access to many parts of the IT system."}],[{"start":162.32,"text":"Teng later said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process”. The company said it had “uncovered additional points of breach” and was still investigating."}],[{"start":177.6,"text":"During the theft, speed was key. Almost all of the $6.3bn was taken in the first 30 minutes, according to Elliptic, with a second, much smaller wave of withdrawals executed about three hours later at 11pm."}],[{"start":191.879,"text":"About $3.8bn worth of Ethereum was stolen, which hackers took by exploiting a new feature introduced last year intended to enable users to give automated software the power to authorise transactions on their behalf."}],[{"start":204.32,"text":"Rafe Pilling at Sophos and other cyber security researchers said the attack had all the hallmarks of a group known as TraderTraitor, a North Korean state-sponsored entity associated with several previous crypto thefts."}],[{"start":216.864,"text":"“They usually begin with compromise of a software developer or engineers’ workstation and use that access to conduct reconnaissance and develop the technical attack,” he said. “This group are experts at mapping out the technical and business processes necessary to make authorised transfers.”"}],[{"start":233.236,"text":"North Korea is the world leader in crypto hacking. The FBI has linked TraderTraitor to at least three crypto heists since 2023, including last year’s $1.5bn theft from crypto exchange Bybit, which was the biggest ever at the time."}],[{"start":248.53,"text":"Nearly $400mn was stolen from crypto exchange Bitget last month, in an attack also linked to North Korean hackers. Larratt of Chainalysis, said investigators had found that some of the wallets used to receive stolen funds from Bitget now also contained funds from Binance."}],[{"start":264.945,"text":"The ability to move billions of dollars in assets across borders almost instantly has made crypto extremely attractive to hackers. Before bitcoin was created in 2009, hackers might compromise a bank account but would then have to move the money through a network of mule accounts and elaborate laundering schemes, such as buying electronic goods before selling them for cash."}],[{"start":289.12,"text":"“That took time, created opportunities for the money to be intercepted, and eroded the criminals’ profits,” Pilling said. “Cryptocurrency removed much of that friction and fundamentally changed the economics of cyber crime.”"}],[{"start":301.538,"text":"Still, the hackers were not able to escape with all of the money. About $2.8bn of the $6.3bn was in Tether and Circle, two dollar-pegged stablecoins. A feature of these tokens is that they can be frozen or destroyed by the companies that issued them."}],[{"start":319.054,"text":"At 9.01pm, Tether issued a freeze command — “addBlackList” — on the hackers’ wallets, followed three minutes later by Circle."}],[{"start":328.2,"text":"This rapid response immediately trapped $1.6bn of Tether and $825mn of Circle. When the hackers moved a further $200mn out of Binance, it was instantly frozen when it entered the blacklisted wallets. Freezes implemented by other companies caught a further $187mn of tokens, according to Elliptic."}],[{"start":352.036,"text":"The freeze event was also the largest in history. The next biggest was an action from April of this year that trapped $344mn in two wallets linked to the Central Bank of Iran."}],[{"start":364.025,"text":"But the hackers were prepared for the move. They were willing to take heavy losses to rapidly move $934mn of Tether before the freezes hit, using decentralised exchanges to swap them for other tokens which cannot be suspended."}],[{"start":null,"text":"