Hackers, Not Users, Lose Money in Attempted Cryptocurrency Exchange Heist

[Faybert]

Binance, one of the largest cryptocurrency exchanges on the Internet, said today that hackers and a well-executed phishing campaign are to blame for the Bitcoin sell-offs from yesterday's afternoon.

The incident the company is referring to happened late yesterday afternoon (Mar 7, UTC 14:58-14:59), when thousands of user accounts started selling their Bitcoin and buying an altcoin named Viacoin (VIA).

The incident looked like a hack, and users reacted accordingly, with many complaining on social media, such as Twitter and Reddit.

"Wtf??? All my coins got sold and I brought [Viacoin]? Did I just get hacked?," a Reddit user wailed.

But this wasn't a hack, or at least not your ordinary hack. The way this was done was incredibly clever.

Hackers ran a tw-month phishing campaign
According to an incident report published by the Binance team, in preparation for yesterday's attack, the hackers ran a two-month phishing scheme to collect Binance user account credentials.

Hackers used a homograph attack by registering a domain identical to binance.com, but spelled with Latin-lookalike Unicode characters. More particularly, hackers registered the bịnạnce.com domain —notice the tiny dots under the "i" and "a" characters.
...
...
...
...

 

[upnorth]

But hackers didn't know one thing —Binance's secret weapon— an internal risk management system that detected the abnormal amount of Bitcoin-Viacoin sale orders within the span of two minutes and blocked all transactions on the platform.

Hackers tried to cash out the 31 Binance accounts, but by that point, Binance had blocked all withdrawals. Furthermore, in the subsequent investigation, Binance identified the 31 accounts, reversed all transactions, and confiscated the original Viacoin funds that hackers deposited in the accounts.

Sounds like a similar setup we have at banks in my country that reacts within a split second on odd transactions. Wonder if the accounts that was phished had some two-step verifications? Should IMO be mandatory as that should normaly blocked any withdrawals as a first line of defence.