Biggest hack in crypto history just happened. Binance lost $6.3 billion in 20 minutes. But net loss is only $1B. Here is what actually happened.
1 Timeline How it happened
Oct 29 7:58 AM IST attacker deployed malicious sweeper smart contract
Oct 29 7:21 PM to 10:17 PM IST dry runs with small USDT USDC test amounts
Oct 29 20:24 UTC which is Oct 30 4:24 AM Taipei time Binance 14 hot wallet swept for 167464 ETH and 63 ERC20 tokens including 1.615B USDT total $2.5B to $3.7B
24 seconds later Binance 16 wallet transferred 28005 ETH plus 55.74M USDT and 25.94M RLUSD to same attacker address
17 minutes later Hot Wallet 34 transferred 780M USDC plus 43M USDC more
Total $6.3B siphoned in 20 minutes across 8 to 10 blockchains
2 Stolen vs Frozen vs Net Loss
Total stolen $6.3B
Total frozen $3B
Tether froze $1.5B to $1.57B USDT
Circle froze $800M to $823M USDC
Additional freeze by Aave and Coinbase
Net unrecovered loss only $1B to $3.3B after freeze
Binance holds $144B total custody so net loss only 0.69 percent to 2.3 percent of total assets. That is why they can cover it.
3 Attack Method Not Private Key
Compromised DevOps engineer laptop gave access to internal service container
No private keys leaked
Abused Ethereum EIP 7702 signature authorization mechanism. This allows account to delegate execution rights through signature authorization
Attacker installed malicious code with sweep function then called sweep to bulk transfer
That is why authorization remained effective for some time and attacker could transfer again from same wallet
4 Who Did It
Attributed to North Korea Lazarus Group TraderTraitor unit
High confidence by TRM Labs Chainalysis ZachXBT Blockaid
Moved assets through Uniswap and Aave borrowing 20000 WETH worth $44M using stolen USDT as collateral to swap freezable stablecoins to non freezable crypto
5 Market Impact
BTC dropped below $79000 and $77000 down 4.8 percent
ETH fell 5.7 percent around $2178 to $2285
BNB dropped 8 to 10 percent
AAVE dropped 11 percent
Over $1.5B in forced liquidations across derivatives
6 Binance Response
User funds 100 percent safe. Customer assets held in isolated cold wallets not affected
Binance will cover 100 percent losses using SAFU fund $1B to $1.17B in BTC plus company reserves
Temporarily suspended deposits withdrawals while rebuilding withdrawal infrastructure aim to resume in 40 to 48 hours
Full post mortem and proof of reserves pending
Leadership
Yi He Co CEO said will cover all hacking losses funds remain secure
CZ said user funds are safe looks like hack and as shareholder all losses will be fully covered
Richard Teng Co CEO confirmed over $6.34B company funds reserved and withdrawal infra being rebuilt and tested
What do you think about EIP 7702 risk. Is centralized freeze power of Tether and Circle good or bad for crypto future. Is your crypto safe on exchanges
