Binance says it has stopped around half of the assets involved in a cyber attack from being moved again, but a cyber-security specialist has warned that recovering the rest could prove impossible.
The cryptocurrency exchange previously said it had frozen about $3bn (£2.24bn) in assets connected with the incident. Investigators are now expected to follow a complicated trail as the attackers attempt to make the funds harder to identify.
Jake Moore, a global cyber-security expert, said criminals were likely to move the digital assets repeatedly in an effort to conceal their origins. He said the money could be transferred thousands of times, creating a lengthy and difficult investigation for those trying to track it.
It is “unlikely” that the remainder of the funds can be physically recovered.
The warning underlines the challenge facing exchanges and investigators when digital assets are taken in a cyber attack. Although transactions recorded on a blockchain can be followed, tracing a movement does not necessarily mean that the money can be returned. Assets may pass through numerous wallets and services before investigators can establish where they have gone.
Why tracing the money may take months
A blockchain is a shared digital record that logs transactions involving a virtual currency. Transactions are grouped into blocks, which are then linked in sequence to create a permanent ledger. This record can provide a route for investigators to examine, but the identity of the person controlling a particular digital wallet is not automatically revealed.
That distinction is central to the Binance investigation. The funds may remain visible on the blockchain while being moved between accounts controlled by people whose identities are unknown. Each additional transfer can make it more difficult to separate the original assets from other digital funds and to establish which wallets are under the attackers’ control.
- About $3bn (£2.24bn) in assets was said by Binance to have been frozen.
- The company has stopped roughly half of the money involved from being transferred again, according to the cyber-security assessment.
- Investigators have been warned that following the remaining funds could take months.
| Issue | What is known |
|---|---|
| Assets frozen | Binance said around $3bn (£2.24bn) had been stopped |
| Funds still at risk | About half of the money involved had been prevented from moving again |
| Investigation | The money may be shifted repeatedly to disguise its trail |
The wider crypto market
Cryptocurrencies differ from national currencies such as the pound, the US dollar and the euro because they are not controlled by centralised financial institutions. People typically obtain them through exchanges such as Binance, although the level of regulation can vary depending on where they live.
Bitcoin is the biggest and best-known cryptocurrency, while Ethereum is another widely used digital currency. Bitcoin is created through mining, in which specialised computers verify transactions and add them to its blockchain. The system has a fixed limit on the number of Bitcoin that can ultimately be produced, a feature that has helped make scarcity part of its appeal to investors.
That appeal comes with sharp risks. The price of Bitcoin can rise rapidly but can also fall steeply, and large movements in its value can affect the wider cryptocurrency market. A major attack on an exchange therefore raises questions not only about the recovery of particular assets, but also about confidence in the systems through which digital currencies are bought and held.
For Binance, the immediate task is to prevent further transfers and help investigators identify the destination of the remaining assets. The company’s reported intervention has contained a substantial portion of the money, but the warning from Mr Moore suggests that containment and recovery are different challenges. Even with a public blockchain record, the path back to the original owners may remain uncertain.
