$BTC The $6.3 billion Binance theft—what actually happened?
A lot of people have messaged me about this over the past few days.
Honestly, my first reaction was confusion too. How could an exchange as big as Binance get robbed of $6.3 billion?
The official preliminary report came out on November 3, so I’ve gone through the key points.
Here’s the timeline.
In June, an infrastructure engineer working on wallets installed an AI coding tool and downloaded a tampered Homebrew installer. Their computer was compromised.
In September, North Korean operatives posed as recruiters conducting job interviews, spreading the malware further.
On October 20, they gained access to an AI tool inside Binance and used it as a stepping stone to compromise two more engineers’ computers.
At 8:05 p.m. on October 29, they made their move.
They didn’t steal any private keys.
That’s an important point.
They gained access to Binance’s internal wallet-signing service and used it to initiate transfers, bypassing the normal withdrawal process.
The Ethereum side was even more outrageous: they used the EIP-7702 mechanism to delegate control over the hot wallet’s execution to a contract they controlled.
Even suspending withdrawals didn’t help. That on-chain delegation kept running until it was removed at 12:10 a.m. on October 30.
In just four minutes, they swept up 233 million XRP, followed by 970,000 SOL, 44.2 million OP, and 18,270 BTC.
The final transfer—2,961.9 ETH—was cashed out at 11:56 p.m.
The total was around $6.34 billion.
On October 31, the FBI issued a statement identifying the perpetrators as the North Korean group known as TraderTraitor.
Binance froze or blocked $2.85 billion.
On October 31, it said that 98% of the affected assets had been replenished, and that the company would cover the losses itself rather than pass them on to users.
On November 1, withdrawals began to resume in stages.
Interestingly, after withdrawals resumed, users promptly withdrew more than $3.6 billion, according to the BBC.
Believe what you will, but it’s reassuring to keep your money in your own pocket.
My takeaway boils down to three points.
Multisig and MPC aren’t foolproof. If the signing service itself is compromised, none of it matters.
Not losing your private keys doesn’t mean you’re safe. Exploiting the authorization mechanism can be enough to drain everything.
No matter how big an exchange is, it’s still someone else’s basket. Don’t put all your eggs in one place.
This is my personal opinion, not investment advice.
Would you still dare to keep most of your funds on an exchange?
#BinanceHack
A lot of people have messaged me about this over the past few days.
Honestly, my first reaction was confusion too. How could an exchange as big as Binance get robbed of $6.3 billion?
The official preliminary report came out on November 3, so I’ve gone through the key points.
Here’s the timeline.
In June, an infrastructure engineer working on wallets installed an AI coding tool and downloaded a tampered Homebrew installer. Their computer was compromised.
In September, North Korean operatives posed as recruiters conducting job interviews, spreading the malware further.
On October 20, they gained access to an AI tool inside Binance and used it as a stepping stone to compromise two more engineers’ computers.
At 8:05 p.m. on October 29, they made their move.
They didn’t steal any private keys.
That’s an important point.
They gained access to Binance’s internal wallet-signing service and used it to initiate transfers, bypassing the normal withdrawal process.
The Ethereum side was even more outrageous: they used the EIP-7702 mechanism to delegate control over the hot wallet’s execution to a contract they controlled.
Even suspending withdrawals didn’t help. That on-chain delegation kept running until it was removed at 12:10 a.m. on October 30.
In just four minutes, they swept up 233 million XRP, followed by 970,000 SOL, 44.2 million OP, and 18,270 BTC.
The final transfer—2,961.9 ETH—was cashed out at 11:56 p.m.
The total was around $6.34 billion.
On October 31, the FBI issued a statement identifying the perpetrators as the North Korean group known as TraderTraitor.
Binance froze or blocked $2.85 billion.
On October 31, it said that 98% of the affected assets had been replenished, and that the company would cover the losses itself rather than pass them on to users.
On November 1, withdrawals began to resume in stages.
Interestingly, after withdrawals resumed, users promptly withdrew more than $3.6 billion, according to the BBC.
Believe what you will, but it’s reassuring to keep your money in your own pocket.
My takeaway boils down to three points.
Multisig and MPC aren’t foolproof. If the signing service itself is compromised, none of it matters.
Not losing your private keys doesn’t mean you’re safe. Exploiting the authorization mechanism can be enough to drain everything.
No matter how big an exchange is, it’s still someone else’s basket. Don’t put all your eggs in one place.
This is my personal opinion, not investment advice.
Would you still dare to keep most of your funds on an exchange?
#BinanceHack