And then there's the part no company can freeze.

Transcript

1. In 2003, Saddam Hussein's son had $1 billion in cash loaded onto 3 trucks.
2. On Thursday night, crypto poured out of Binance,
3. the world's biggest crypto exchange.
4. Binance estimates the total impact at about $6.3 billion.
5. More than 6 times as much.
6. In $100 bills, that would weigh about 63 tonnes.
7. Nobody needed a truck.
8. The blockchain analysis firm TRM traced transfers across 10 networks.
9. Most of the money left in about 20 minutes.
10. The biggest share was on the Ethereum network.
11. There, a single transaction sent the attacker $1.6 billion in Tether,
12. 167,000 ether, and 62 other tokens.
13. 3.5 minutes earlier,
14. the attacker had taken control of one of Binance's withdrawal wallets.
15. The permission carried that wallet's own digital signature.
16. Tether is a token a company issues, designed to stay worth $1.
17. That company can freeze it.
18. Ether has no company like that behind it.
19. TRM says the attacker raced the freezes,
20. selling $325 million of Tether for ether at a loss of more than 10%.
21. At 21:01, 37 minutes after the transaction, Tether blacklisted the attacker's address.
22. In Tether's code, the function for that is called add blacklist.
23. And the address it takes has a name.
24. Evil user.
25. It froze 971 million Tether tokens.
26. 3 minutes later, another company, Circle, froze 823 million of its own digital dollar.
27. By 1 am, Binance said about $3 billion had been frozen.
28. Frozen isn't returned.
29. The attacker just can't spend it.
30. Binance says it will cover all losses.
31. Its first findings pointed to a hacked engineer's laptop,
32. which may have let the attacker use an internal service to send withdrawals.
33. Since then, Binance says it has found more points of breach.
34. TRM and a second firm, Chainalysis,
35. say it was most likely the work of a North Korean hacking unit.
36. Binance hasn't named anyone.
37. And then there's the part no company can freeze.
38. At 00:30, TRM counted more than 420,000 ether
39. and 18,000 bitcoin still with the attacker.
40. About $2.4 billion.
41. CoinDesk traced the bitcoin into 19 wallets.
42. 17 of them received exactly 1,000.
43. And then, nothing.
44. This morning, none of the bitcoin had moved.
45. Some of the ether already has.
46. TRM expects it to go next through brokers and swap services,
47. and it's watching for that.