It started like any other evening on crypto Twitter. Then at exactly 20:05 UTC, the chain started screaming. đ¨
Within 20 minutes, Binance hot wallets across 8 chains were swept clean. An estimated $6.3 billion - the largest crypto heist in history.
What Really Happened? The First 20 Minutes
At 20:24 UTC, a hot wallet labeled "Binance 14" executed a single transaction: 167,464 ETH + 1.615B USDT + 63 other tokens - worth âź$2.5B in one click. 1fad
24 seconds later, "Binance 16" was drained. Then Hot Wallet 34. Then Bitcoin, Solana, Tron, XRP. All to the same receiving address. 1fad
Traders watching Arkham saw billions moving in real-time. Was this internal? Was this the end?
How Did They Get In? Not Private Keys.
This is what makes this hack terrifying.
Binance's postmortem revealed it wasn't a private key leak. It was a multi-month, multi-stage campaign. 0274
1. June: An engineer downloaded a tampered package while setting up an AI coding tool
2. Fake Job Interview: North Korean hackers used a fake interview to trick a Binance DevOps engineer into installing malware on his work laptop
3. October 20: Attackers used that access + an internal AI tool to compromise two more engineers and steal a container deployment token
4. October 29: They deployed the malicious container and triggered the sweep script 0274
On-chain, they abused Ethereum's EIP-7702 - a feature that lets a wallet delegate execution rights via a signature. Trick someone into signing once, and you can install code that sweeps the wallet. 1fad
The FBI has attributed the attack with high confidence to TraderTraitor, linked to North Korea's Lazarus Group. 372c
The Response: $3 Billion Frozen in Hours
This could have been much worse.
Within hours, Tether froze $1.57B, Circle froze $800M+, Ripple, Paxos and others joined - totaling ~*$3 billion frozen on-chain*. 372c
Binance immediately:
- Paused crypto withdrawals (deposits stayed open)
- Revoked the EIP-7702 authorization
- Activated the SAFU emergency fund (âź$1.2B) + corporate treasury
Binance's commitment: "Binance will cover all hacking losses. User funds are safe". 3113
By October 30-31, Binance said it had already replaced 80% then 90% of affected assets and was buying the rest from markets and OTC, with a phased restoration of withdrawals planned. e5d0
Initial Findings Update - What We Know Today:
mpact Estimate: âź$6.3B drained, âź$3.3B still movable (mostly BTC/ETH) after freezes
No private keys leaked according to Binance initial investigation
Additional breach points found beyond the first laptop - this was not a simple phishing incident 2517e5d04bcc
This was not just a hack. It was a wake-up call for the entire industry. â ď¸
Binance says it blocked 57 suspected North Korea-linked threats this year alone. This one got through.
Stay tuned - full technical postmortem is expected in the next 48 hours.
This is a developing story. Withdrawals remain phased, always use official Binance channels.
