Binance freezes $3 million worth of crypto stolen in Ankr hack

Binance, one of the last remaining crypto giants, froze about $3 million worth of cryptocurrency early on Friday morning after Web3 infrastructure provider Ankr was hacked. 

Ankr said $5 million worth of Binance coin was stolen from the platform and that it planned to cover all of the losses suffered by its users. Another platform, Helio, confirmed that it was also hit in a connected attack.

The team at Ankr has assessed the damage and it is max 5M USD worth of BNB from the liquidity pools.

We are currently working hard to resolve this issue efficiently and we would like to propose the following to address the current situation:

— Ankr (@ankr) December 2, 2022

“Ankr understands the concern this has created within the community and will continue working to mitigate the situation and has already taken the necessary steps to prevent future similar incidents,” the company said on Friday. 

Binance CEO Changpeng Zhao said the platform was pausing withdrawals of Ankr tokens and noted that the attack on Ankr involved the hack of a developer private key – a secret number that is used in cryptography, similar to a password.

Lance Morginn, president at Blockchain Intelligence Group, explained that Ankr is a distributed node operator for proof-of-stake networks, letting users stake their tokens easily without having to buy the necessary hardware.

The hack started when someone used the developer private key to mint 6 quadrillion aBNBc – Ankr’s cryptocurrency. The hacker then exchanged aBNBc for other assets, including nearly 4.5 million USDC – a cryptocurrency pegged to the US dollar, which it then swapped for ETH. 

The hacker sent about $3 million of the stolen funds to Tornado Cash – a popular mixing service used by cybercriminals and nation states to obfuscate the source of funds and turn cryptocurrency into fiat currency. 

Morginn said the service “ensures that the source of the funds is untraceable, providing total asset privacy,” adding that the hacker’s wallet now has more than $1 million worth of Ethereum, $29,000 worth of Binance coin and more than $775,000 worth of Polygon. 

It was unclear exactly how much was stolen in the attack after another crypto platform, Helio, said it was compromised in connection to Ankr’s incident.

1/ The team at Helio Protocol is aware of the situation and we are closely working with @Ankr to manage the situation and to support our community during this difficult time.

— Helio Protocol ($HAY) (@Helio_Money) December 2, 2022

BlockSec, a cryptocurrency security company, told The Record that hack was much larger, involving at least $15 million worth of cryptocurrency, an amount the blockchain security firm PeckShield confirmed.

Helio did not respond to requests for comment but did note in a series of tweets that its platform was involved in the hack. 

PeckShield reported that as of November, more than $3.37 billion has been stolen from cryptocurrency platforms this year.

#PeckShieldAlert 29 exploits, including Deribit hot wallet compromised & FTX Accounts Drainer grabbed $391.6M in November 2022
As of November 2022, the stolen crypto total hits $3.37B
Exchange inflows are more likely to be captured by DEXs due to the downfall of CEXs such as FTX pic.twitter.com/JNr1e9xQJm

— PeckShieldAlert (@PeckShieldAlert) November 30, 2022