![](\"https:\/\/media.wired.com\/photos\/5cd30897c5bf0a542c1d96a2\/master\/pass\/binance-903631422.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Brian Barrett| Date: Wed, 08 May 2019 17:20:08 +0000<\/strong><\/p>\n Binance is one <\/span>of the world\u2019s biggest cryptocurrency exchanges<\/a>. As of Tuesday, it\u2019s now also the scene of a major cryptocurrency theft. In what the company calls a \u201clarge scale security breach,\u201d hackers stole not only 7,000 bitcoin\u2014equivalent to over $40 million\u2014but also some user two-factor authentication<\/a> codes and API tokens.<\/p>\n Theft has long been endemic to cryptocurrency<\/a>; hackers stole more than $356 million from exchanges and infrastructure in the first three months of 2019 alone, according to a recent report from blockchain intelligence company Ciphertrace. But it\u2019s less common to see an established exchange like Binance get hacked\u2014and for the attackers to get so much other information along the way.<\/p>\n Binance has been fairly forthcoming about the hack, detailing its impact in a blog post<\/a> from Binance CEO Zhao Changpeng. \u201cThe hackers used a variety of techniques, including phishing, viruses and other attacks,\u201d said Zhao. \u201cThe hackers had the patience to wait, and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time. The transaction is structured in a way that passed our existing security checks.\u201d<\/p>\n It appears that hackers were able to compromise several high net worth accounts, whose bitcoin was kept in Binance\u2019s so-called hot wallet\u2014which unlike cold wallets are connected to the internet\u2014and filch those funds in a single transaction<\/a>.<\/p>\n Zhao says the company will conduct a security review of all its systems and data, which he expects to take about a week. In a surprising move, Binance will continue to allow trading during that time\u2014even though hackers may still control some high net worth accounts\u2014though it will disable deposits and withdrawals until it\u2019s sure the hackers are accounted for.<\/p>\n \u201cBinance knows that they lost user credentials, that their users' 2FA got compromised, they do not know the exact extent of the attack, yet they keep trading going,\u201d says Emin G\u00fcn Sirer, a computer scientist and codirector of Cornell University\u2019s Initiative for Cryptocurrencies and Contracts. \u201cThis is a huge risk. Anyone can take highly risky positions, and if the trades turn sour, they can claim that it wasn't them, they were compromised by the hack.\u201d<\/p>\n Good question! Binance itself isn\u2019t clear on the scope of the breach. The bad news is, if your bitcoin was in Binance\u2019s hot wallet, it now belongs to bad guys. The good news is, that $40 million comprises only two percent of Binance\u2019s overall bitcoin holdings. The even better news is that the company will cover the losses out of its Secure Asset Fund for Users.<\/p>\n Binance traders generally will also be affected, both because they won\u2019t be able to deposit or withdraw their digital money and because, as Sirer notes, the uncertainty of who exactly is participating in those markets could lead to some mayhem. \u201cHackers may still control certain user accounts and may use those to influence prices in the meantime,\u201d writes Zhao. \u201cWe will monitor the situation closely. But we believe with withdrawals disabled, there isn\u2019t much incentive for hackers to influence markets.\u201d<\/p>\n The more interesting question might be who could<\/em> have been affected, not by the hack itself but by Binance\u2019s reaction. The company apparently considered doing a rollback on the bitcoin network, to undo the offending transaction. They ultimately decided against it, but even the specter has implications.<\/p>\n \u201cIt takes only a handful of miners who will go along with a reorg. And perhaps they wouldn't do it for $40 million, but there is a price at which they would do it,\u201d says Sirer. \u201cIf it were to happen, it would undermine confidence in BTC, whose main claim to fame has always been security and immutability.\u201d<\/p>\n At the very least, all Binance users need to update their API keys and two-factor authentication immediately.<\/p>\n On the face of it, maybe not so bad. Forty million is a plenty big number, but it\u2019s only a small percentage of Binance funds, and users will apparently get their money back.<\/p>\n But the fact that Binance can afford to take a mulligan doesn\u2019t excuse what appears to be a devastatingly thorough hack. And it\u2019s unclear whether the compromise of two-factor codes and API keys will have broader implications. Most of all, it\u2019s the latest reminder that for all the promise of cryptocurrency, it remains a Wild West for investors. If the price fluctuations don\u2019t get you, a hacker, a fraud, or a scam<\/a> is always just around the corner.<\/p>\n