BINANCE - BIGGEST HACK EVER, $6.3 BILLION WORTH OF ASSETS STOLEN [UPDATED]

[mikel_012]

6 billion. The most revealing lesson for those who kept coins there, not understanding the principle "not your keys, not your coins."

Yes, the total amount can be seen in real time: https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8

Now the value is: $5,852,216,453.73

But some is frozen like USDT and USDC, so this money will be recovered for sure

The problem is the BTC and the ETH

[shinratensei_]

Another day another hacking, billions just vanished like that. The real question is, how the hell the hacker able to get EIP-7702 authorization signed by Binance's 14 privkey? either they got the private key leaked or it's the same pattern as Bybit's hack, they tricked Binance's signing layer. Honestly it's baffling how the hacker can get ahold of the EIP-7702 authorization of Binance 14 that helps delegate instruction to sweep any address Binance 14 controlled. Ridiculous.

[Dogedegen]

They are all 4 on the eth network. Less than $200 total but not the point. These transactions have been pending for a few hours now.


**EDIT**
Actually just checked and the transactions have now gone through.

I don't think that the whole network would be frozen unless there is a core protocol compromise that is directly related to ETH's upgrades and that could affect other things. Since the attacks are limited to platforms for now, this is unlikely. Stablecoin providers could pause transfers on their tokens, but that would be clear with on chain interactions from the token owners and I don't see that now either. They wouldn't do it either if it is only a hack of Binance, it would have to be much bigger than this. Unless you meant the network is frozen on the platform only, that would be something else. Anyway I am glad they have gone through.

At first saw that $2.71B had been hacked. But few minutes later we saw another news report saying that a total of $5.0B had been hacked.

This amount increased within a moment, we couldn't understand anything. Everyone is waiting to see the statement about how much was lost in the end.

Calm and patience is what is needed rather than some people panicking about FUD scenarios that Binance is going to go bust after this or something. For such a rich and profitable business, I would be more concerned that I would go bankrupt if I lost $20 than if Binance lost $5 billion.  

Another day another hacking, billions just vanished like that. The real question is, how the hell the hacker able to get EIP-7702 authorization signed by Binance's 14 privkey? either they got the private key leaked or it's the same pattern as Bybit's hack, they tricked Binance's signing layer. Honestly it's baffling how the hacker can get ahold of the EIP-7702 authorization of Binance 14 that helps delegate instruction to sweep any address Binance 14 controlled. Ridiculous.

It does not make sense this theory, how could the Bitcoin balance be hacked if it was done only with EIP-7702? This theory is weak because of that, there must be more to the story.

[shinratensei_]

It does not make sense this theory, how could the Bitcoin balance be hacked if it was done only with EIP-7702? This theory is weak because of that, there must be more to the story.

I think so, everything seems to point into infrastructure compromise, maybe their signing layer is the problem. I was having the impression that the BTC which got drained might be WBTC which is sweepable through the delegation but apparently even the BTC that is on the Bitcoin's blockchain got stolen because theoretically drain only possible if the blockchain supported smart contract. Everything points to hacker having access to key whether direct or indirectly but I might be wrong about this. Still waiting from various blockchain forensic analysts report.

[Dave1]

Arkham did create a tracker to see the movement, and they name it binance-hacker-1029 with 66 71 addresses.



https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8

And if you are going to look at it, the addresses keeps on moving real time and we can only assume that they are going to every protocols, hops to try and evade the investigators on tracking down their addresses.

[yahoo62278]

They are all 4 on the eth network. Less than $200 total but not the point. These transactions have been pending for a few hours now.


**EDIT**
Actually just checked and the transactions have now gone through.

I don't think that the whole network would be frozen unless there is a core protocol compromise that is directly related to ETH's upgrades and that could affect other things. Since the attacks are limited to platforms for now, this is unlikely. Stablecoin providers could pause transfers on their tokens, but that would be clear with on chain interactions from the token owners and I don't see that now either. They wouldn't do it either if it is only a hack of Binance, it would have to be much bigger than this. Unless you meant the network is frozen on the platform only, that would be something else. Anyway I am glad they have gone through.

Looks like I mis spoke and the delay was just due to higher fees. Listening to others talk and not researching before I spoke. Everything appears to be fine with the wallet now, just a higher fee than normal.

[Lucano]

Withdrawals are pending. This incident has forced me to withdraw all my funds from all exchanges. This incident is very dire, and the impact is felt by everyone, especially security. Binance is the world's largest exchange, and they could be compromised. Hopefully, everyone can recover. This is the worst incident this year in the exchange sector.

[PostQuantumBTC]

Withdrawals are pending. This incident has forced me to withdraw all my funds from all exchanges. This incident is very dire, and the impact is felt by everyone, especially security. Binance is the world's largest exchange, and they could be compromised. Hopefully, everyone can recover. This is the worst incident this year in the exchange sector.

We told them but they did not listen. If anything happen to Binance now, some people can lose money. If anyone need their money today or tomorrow and depend on the money, they can not be able to withdraw the money on Binance for now. If the money are on their self-hosted wallet, they will have the full control of it.

[promise444c5]

Withdrawals are pending. This incident has forced me to withdraw all my funds from all exchanges. This incident is very dire, and the impact is felt by everyone, especially security. Binance is the world's largest exchange, and they could be compromised. Hopefully, everyone can recover. This is the worst incident this year in the exchange sector.

That’s a nice decision   hope you didn’t choose TW again..

CZ I trust you that our funds are Safu, I have a few thousands dos there.

He’s not the CEO anymore, he already step down not too long. But he’s still a Co-founder and shareholder , so you’re calling up on the wrong guy.  The only thing he can can do at the moment is to  keep the public calm a bit with more X post.

You all are calculating the SAFU like it’s transparent.. or where are you guys checking it  

[Juse14]

CZ I trust you that our funds are Safu, I have a few thousands dos there.

He’s not the CEO anymore, he already step down not too long. But he’s still a Co-founder and shareholder , so you’re calling up on the wrong guy.  The only thing he can can do at the moment is to  keep the public calm a bit with more X post.

You all are calculating the SAFU like it’s transparent.. or where are you guys checking it  

By continuing to talk CZ in X there is a possibility to muffle the panic that occurs today, because the other CO is not so much attention in the appeal of CZ that continues to be highlighted by other users.

What about the others, is the withdrawal properly Deferred even though there has been an official announcement? Luckily he doesn't have any assets there so no worries at all.

Currently only using Kucoin as an exchange, still this will not escape its later hacker attacks.

[TastyChillySauce00]

You all are calculating the SAFU like it’s transparent.. or where are you guys checking it  

If what you guys mean by SAFU is the SAFU fund, it's actually pretty transparent, even mentioned here https://www.binance.com/en/support/faq/detail/028799e730294ae4a9b382d60d350116 the bitcoin address holds 15,000 BTC approximately $1.1B which isn't enough to cover for the losses. Binance is going to reach deep into their pocket to make their user whole this time.

I'm curious what happen after this, their SAFU fund becoming 0 again? since from my understanding these fund was grown from small percentage of trading fees.

[julerz12]

Another day another hacking, billions just vanished like that. The real question is, how the hell the hacker able to get EIP-7702 authorization signed by Binance's 14 privkey? either they got the private key leaked or it's the same pattern as Bybit's hack, they tricked Binance's signing layer. Honestly it's baffling how the hacker can get ahold of the EIP-7702 authorization of Binance 14 that helps delegate instruction to sweep any address Binance 14 controlled. Ridiculous.

Binance is now saying that someone got access to a DevOps engineer’s laptop that allowed them to submit unauthorized withdrawal transactions. Binance also stated that no evidence of any wallet private key was leaked.
Withdrawals/Deposits are still paused within the platform, and the estimated total amount is now at $6.3B.
Source: https://x.com/binance/status/2115993361517891592
^{Looks like someone will get axed. lol}

I'm curious what happen after this, their SAFU fund becoming 0 again? since from my understanding these fund was grown from small percentage of trading fees.

Either they'll replenish it in full - which would mean the funds will have to come from Binance itself or grow it again slowly from trading fees.

[Mahiyammahi]

I woke up now it's $5.6B , op edit the title and update it over time. Only centralized exchange was left without hacking. I think centralized era will end soon.

Around $3B asset has been frozen by Tether & Circle. Remaining funds are 0.7% of total fund which can cover Binance losses.

Report says - A employee Laptop has been compromised and it might be the reason for the hack. What a day man.
Woke up and saw this new, I did sold my remaining fund on Binance. I was lucky that I don't hold enough fund on Binance all is in my wallet.

[DanWalker]

Withdrawals are pending. This incident has forced me to withdraw all my funds from all exchanges. This incident is very dire, and the impact is felt by everyone, especially security. Binance is the world's largest exchange, and they could be compromised. Hopefully, everyone can recover. This is the worst incident this year in the exchange sector.

We told them but they did not listen. If anything happen to Binance now, some people can lose money. If anyone need their money today or tomorrow and depend on the money, they can not be able to withdraw the money on Binance for now. If the money are on their self-hosted wallet, they will have the full control of it.

There is no such thing as being 100% safe in this industry. Your funds may be frozen or withdrawal suspended if an exchange encounters problem. But you could still lose everything in blink of an eye if you are hit by a security flaw like the recent coldcard or ledger incidents. Worse still , nobody's  going to compensate you if that happen.

The fix is to spread your stack across multiple places instead of hoping for some silver bullet that keeps you 100% safe.

[noorman0]

If what you guys mean by SAFU is the SAFU fund, it's actually pretty transparent, even mentioned here https://www.binance.com/en/support/faq/detail/028799e730294ae4a9b382d60d350116 the bitcoin address holds 15,000 BTC approximately $1.1B which isn't enough to cover for the losses. Binance is going to reach deep into their pocket to make their user whole this time.

I'm curious what happen after this, their SAFU fund becoming 0 again? since from my understanding these fund was grown from small percentage of trading fees.

The value successfully frozen by token issuers following this incident continues to rise, which in turn reduces the amount that Binance will have to cover. The latest reports indicate that nearly $3 billion has now been frozen.

Entity/Network	|	Value Frozen	|	Asset Type
Tether	|	≈ US$1.57B	|	USDT
Circle	|	≈ US$800M+	|	USDC
Ripple	|	≈ US$200M	|	RLUSD
WLFi + BitGo	|	≈ US$29M	|	USD1 & related assets
Arbitrum Security Council	|	US$30.5M	|	74,6M ARB + 8.425 ETH
...	|	...	|	...

Summarized and compiled into a table with the help of Gemini.

[greysonz]

Binance believes the attack was caused by a compromised DevOps engineer's laptop. The attacker used it to gain access to the service container and send unauthorized withdrawal transactions.
6.3 billion were stolen, half of which has been frozen.
The exchange promises to cover all losses for the victims.
Deposits and withdrawals have been temporarily suspended.

https://x.com/binance/status/2115993361517891592?a=rTxc8SRbqC76yTEQF9Y&s=19

[LuckyCrypto777]

ZachXBT  suggested that the organization that attacked Binance this time and stole $6 billion worth of cryptocurrency was the General Intelligence Agency of the General Staff of the Korean People's Army, which controls the Lazarus group.

[noorman0]

Binance believes the attack was caused by a compromised DevOps engineer's laptop.

Yeah, that's it. It even goes to show that the implementation of the EIP-7702 protocol is completely meaningless, since access to $6 billion worth of funds hinges on nothing more than a single laptop. Binance is far more centralized than the public has been led to believe.

It honestly makes me want to throw up,

[Bd officer]

The fix is to spread your stack across multiple places instead of hoping for some silver bullet that keeps you 100% safe.

This is the best way. There is a common saying that you should not put all your eggs in one basket.
Personally, I use multiple exchanges for trading. I consider myself lucky because I withdrew all my funds from Binance yesterday. So for now, I am not affected by this issue.
Anyway, maybe it has affected the market, Bitcoin price fell to $76.5k but is going up again.

[greysonz]

ZachXBT  suggested that the organization that attacked Binance this time and stole $6 billion worth of cryptocurrency was the General Intelligence Agency of the General Staff of the Korean People's Army, which controls the Lazarus group.

Yes, it is highly likely Lazarus.

Because the TRX stolen from Binance passed through the Bitget Wallet bridge during the laundering process.The  destination address had previously been used by the hacker associated with the Phemex hack.


https://x.com/MistTrack_io/status/2116021647279005841?s=19