Binance bounty offered for info on attempted attack

After stopping an attempt to steal cryptocurrency, a Binance bounty is being offered for information on the threat actor behind the failed theft.

The large-scale attack occurred on March 7, and it was blocked within two minutes, according to the company. But Binance said it doesn't want to "simply play defense." Rather, it wants to be more proactive in preventing cryptocurrency theft.

"Even though the hacking attempt against Binance on March 7th was not successful, it was clear it was a large-scale, organized effort. This needs to be addressed," Binance wrote in a blog post. "Binance is offering a $250,000 USD equivalent bounty to anyone who supplies information that leads to the legal arrest of the hackers involved in the attempted hacking incident on Binance on March 7th, 2018."

The Binance attack on March 7 was not the first attempt, either. The company said the threat actors gathered user credentials via a phishing campaign, which began in early January 2018 and ramped up in mid-February. Using those credentials, the hackers triggered a large amount of transactions in an attempt to steal bitcoin from Binance users via fraudulent trades. The exchange's "automatic risk management system was triggered," stopping the trades and effectively ending the Binance attack.

It's unclear why the Binance bounty has been offered publicly, rather than commissioning a cybersecurity vendor to investigate the incident and attribute the attack. It's also unclear how many Binance users were affected by the phishing attack. The company did not respond to requests for comment.

The company promised "the first person to supply substantial information and evidence that leads to the legal arrest of the hackers, in any jurisdiction," will earn the Binance bounty of $250,000 worth of the exchange's proprietary Binance coin, based on the exchange rate at the time of the transfer. This means the value of the Binance bounty can fluctuate, if the receiver doesn't cash out right away.

Additionally, the company said it will create a fund of $10,000,000 to pay similar bounties in the event of a future Binance attack. Collecting the Binance bounty could be challenging, because it requires a "legal arrest" of the threat actors and not just identification or indictments.

Recently, while there have been high-profile arrests -- like National Security Agency contractor Hal Martin, who stole classified materials and cyberweapons over the course of 20 years -- threat actors such as those behind the Yahoo data breach were indicted and not arrested.

The attempted attack on Binance is the latest in a trend of cryptocurrency-related malicious activity. Threat actors have been increasingly targeting cryptocurrency exchanges with cyberattacks, including the theft of nearly $80,000,000 in bitcoin. Additionally, there has been a growing trend of cryptojacking attacks in which malicious code is implanted on a target system to skim processing power for mining cryptocurrency.