Hackers, Not Users, Lose Money in Attempted Cryptocurrency Exchange Heist

Binance, one of the largest cryptocurrency exchanges on the Internet, said today that hackers and a well-executed phishing campaign are to blame for the Bitcoin sell-offs from yesterday's afternoon.

The incident the company is referring to happened late yesterday afternoon (Mar 7, UTC 14:58-14:59), when thousands of user accounts started selling their Bitcoin and buying an altcoin named Viacoin (VIA).

The incident looked like a hack, and users reacted accordingly, with many complaining on social media, such as Twitter and Reddit.

"Wtf??? All my coins got sold and I brought [Viacoin]? Did I just get hacked?," a Reddit user wailed.

But this wasn't a hack, or at least not your ordinary hack. The way this was done was incredibly clever.

Hackers ran a tw-month phishing campaign

According to an incident report published by the Binance team, in preparation for yesterday's attack, the hackers ran a two-month phishing scheme to collect Binance user account credentials.

Hackers used a homograph attack by registering a domain identical to binance.com, but spelled with Latin-lookalike Unicode characters. More particularly, hackers registered the bịnạnce.com domain —notice the tiny dots under the "i" and "a" characters.

Phishing attacks started in early January, but the Binance team says it detected evidence that operations ramped up around February 22, when the campaign reached its peak.

Binance tracked down this phishing campaign because the phishing pages would immediately redirect phished users to the real Binance login page. This left a forensic trail in referral logs that Binance developers detected. The company's CEO shared a screenshot of one of these logs on Twitter, yesterday.

Hackers gained access to accounts and generated API keys

After getting access to several accounts, instead of using the login credentials to empty out wallets, hackers created "trading API keys" for each account.

With the API keys in hand, hackers sprung their main attack yesterday. Crooks used the API keys to automate transactions that sold Bitcoin held in compromised Binance accounts and automatically bought Viacoin from 31 other Binance accounts that hackers created beforehand, and where they deposited Viacoin, ready to be bought.

But hackers didn't know one thing —Binance's secret weapon— an internal risk management system that detected the abnormal amount of Bitcoin-Viacoin sale orders within the span of two minutes and blocked all transactions on the platform.

For once, it was the hackers who lost money

Hackers tried to cash out the 31 Binance accounts, but by that point, Binance had blocked all withdrawals. Furthermore, in the subsequent investigation, Binance identified the 31 accounts, reversed all transactions, and confiscated the original Viacoin funds that hackers deposited in the accounts.

So, in the end, the hackers actually lost both money and time carrying out this attempted heist. How much they lost is currently unknown.