$BTC
I finished reading Binance’s postmortem on the theft, and the details are crazier than I expected
It started back in June
A developer working on wallets wanted to download an AI coding tool and clicked on an infected installer hidden in a Google ad
The security team spotted it at the time, switched computers, and thought everything was fine
But they missed the second wave of the attack, which directly deleted the pyenv executable and left a backdoor
On October 20, the hackers used Binance’s own internal AI tool to gain control of two engineers’ wallets
They launched the attack in earnest shortly after 8 p.m. on October 29, and siphoned off $6.3 billion in less than 4 hours
Why couldn’t it be stopped? The hot wallet used MPC, so there wasn’t a single private key that could immediately revoke that EIP-7702 authorization
They had to watch helplessly as the money disappeared for nearly two hours
The FBI attributed it to North Korea’s TraderTraitor
Binance says it has bought back 98% of the coins using its own funds, and $2.85 billion was frozen or intercepted
The remaining 2% is in small, illiquid coins, which they’re buying back gradually
Withdrawals have mostly returned to normal, and HYPE and APT were also unlocked yesterday
Honestly, the postmortem is pretty detailed, but there’s one thing I have to nitpick
On October 31, it said 90% had been replenished; on November 2, it said 95%
Now the postmortem says it was already 98% on October 31
The figures don’t line up, and the reporting is a bit messy. I’ll make a note of it for now
The market didn’t wait around
BTC is at 73844 now, and it’s almost hit that 73500 level again
ETH at 2086, XRP at 1.0859—not even 1.09 held
73200 is the 200-day moving average; if it breaks, we really could head toward 72000
Still weak until it gets back above 75000, so don’t rush to buy the dip
October CPI comes out tomorrow night at 21:30. Don’t take on too much risk ahead of the data
Personal analysis, not investment advice
#Binance
I finished reading Binance’s postmortem on the theft, and the details are crazier than I expected
It started back in June
A developer working on wallets wanted to download an AI coding tool and clicked on an infected installer hidden in a Google ad
The security team spotted it at the time, switched computers, and thought everything was fine
But they missed the second wave of the attack, which directly deleted the pyenv executable and left a backdoor
On October 20, the hackers used Binance’s own internal AI tool to gain control of two engineers’ wallets
They launched the attack in earnest shortly after 8 p.m. on October 29, and siphoned off $6.3 billion in less than 4 hours
Why couldn’t it be stopped? The hot wallet used MPC, so there wasn’t a single private key that could immediately revoke that EIP-7702 authorization
They had to watch helplessly as the money disappeared for nearly two hours
The FBI attributed it to North Korea’s TraderTraitor
Binance says it has bought back 98% of the coins using its own funds, and $2.85 billion was frozen or intercepted
The remaining 2% is in small, illiquid coins, which they’re buying back gradually
Withdrawals have mostly returned to normal, and HYPE and APT were also unlocked yesterday
Honestly, the postmortem is pretty detailed, but there’s one thing I have to nitpick
On October 31, it said 90% had been replenished; on November 2, it said 95%
Now the postmortem says it was already 98% on October 31
The figures don’t line up, and the reporting is a bit messy. I’ll make a note of it for now
The market didn’t wait around
BTC is at 73844 now, and it’s almost hit that 73500 level again
ETH at 2086, XRP at 1.0859—not even 1.09 held
73200 is the 200-day moving average; if it breaks, we really could head toward 72000
Still weak until it gets back above 75000, so don’t rush to buy the dip
October CPI comes out tomorrow night at 21:30. Don’t take on too much risk ahead of the data
Personal analysis, not investment advice
#Binance
