Binance, a leading cryptocurrency exchange, is offering a bounty equivalent of $250,000 USD in BNB in cryptocurrency for information that leads to the arrest of the hackers involved in a recent phishing attempt. On top of this, they are maintaining a $10 million cryptocurrency reserve for bounties to nab hackers in the future.

In a statement, Binance addressed the importance of going on the offensive against attempted hacks:

To ensure a safe crypto community, we can’t simply play defense. We need to actively prevent any instances of hacking before they occur, as well as follow through after-the-fact. Even though the hacking attempt against Binance on March 7th was not successful, it was clear it was a large-scale, organized effort. This needs to be addressed.

During the attempted scheme, the Viacoin (VIA) to Bitcoin (BTC) market experienced “abnormal trading activity.” Luckily, Binance’s automatic risk management system was flagged, and all withdrawals were halted immediately. After the incident, Binance quickly released a statement announcing all funds were safe.

The security incident involved some irregularities in the use of API keys, which resulted from a phishing campaign lasting a few months. The actual attack took only two minutes. Binance said in one of their statements:

The phishers accumulated user account credentials over a long period of time. The earliest phishing attack seems to have dated back to early Jan. However it was around Feb 22, where a heavy concentration of phishing attacks were seen using unicode domains, looking very much like binance.com, with the only difference being 2 dots at the bottom of 2 characters. Many users fell for these traps and phishing attempts. After acquiring these user accounts, the phishers then simply created a trading API key for each account but took no further actions, until yesterday.

Further suspicion grew when the phishing accounts on Binance started placing a large number of market buys for Viacoin, a low-value cryptocurrency, through Bitcoin. This low volume cryptocurrency quickly increased to a high price, and 31 pre-deposited accounts were there to sell VIA at that high price. It was at this time the Binance system flagged the trading and withdrawals were cut off when the attempted withdrawal was made.

Binance said, “Not only did the phishers fail to steal any coins, their own coins have also been withheld.”

Binance noted the hackers appeared both organized and patient. They gathered their information throughout a couple months’ time, then chose a coin with a smaller market cap to help “maximize their own gains.”

Binance has shown transparency throughout this incident, with further information from the statement:

After a thorough security check by Binance, we resumed withdrawals. Trading functionality was never affected. There are still some users whose accounts whwere phished by these phishers and their BTC were used to buy VIA or other coins. Unfortunately, those trades did not execute against any of the phishers’ accounts as counterpart. As such, we are not in position to reverse those trades. We again advise all traders to take special precaution to secure their account credentials…..Protecting our traders is and has always been our highest priority.