BINANCE - BIGGEST HACK EVER, $6.3 BILLION WORTH OF ASSETS STOLEN [UPDATED]

[oll]

Binance updated the incident status. I wonder what factors they're talking about. Is there anything else besides the engineer's laptop?

[greysonz]

This guy made a nearly accurate prediction two years ago: EIP-7702 radically increases the cost of a single signature error.



I don't understand how the hacker got these 50 genuine signatures for the Binance key.
He couldn't have simply guessed them. So, he either somehow manipulated the Binance signature system into signing malicious data, or gained access to the key.

[retreat]

This is the same face that said 'user funds are SAFU.' He can say that everything is fine and under their control, but that face can't lie. It's not fine. Binance is burning right now.

This image was taken from an interview some time ago, where the presenter pressed him with the question of whether Binance could survive. He answered with "great confidence" and "enthusiasm".



He keeps acting like Binance is safe and secure from his tweets and often advises people to use the exchange. But there's no such thing as 100% safe in this industry. That platform he brags about won't be immune to hacking either.

[KingsDen]

ZachXBT  suggested that the organization that attacked Binance this time and stole $6 billion worth of cryptocurrency was the General Intelligence Agency of the General Staff of the Korean People's Army, which controls the Lazarus group.

Like who are these Lazarus groups?
They remind me a book I read as a kind - a man called Gardoky. It was written that anywhere there is war and trouble, Gardoky is there. Is this applicable to Lazarus group? Anywhere there is hack and theft, Lazarus group must be directly or indirectly mentioned.

[OcTradism]

Some speculations on this hack with possible hackers are from Lazarus Group again but let's wait for first detailed report from Binance after they finish their investigation as well as security audits.

It's the speculation in the community only but honestly I am not surprised if again Lazarus Group is named as the attacker. In coming days and weeks, no-KYC exchanges will have very uncertain future because with this biggest hack ever in cryptocurrency history, hackers will launder their money soon. Except stablecoins that were already frozen and will be frozen more, other cryptocurrencies will be laundered by the attackers.

[Woodie]

So apparently this hacker knew these assets would get frozen, and to outsmart the system he used Defi to get Eth against the stolen coins on Aave...damn this happened so fast and was certainly two steps ahead , now the loss still goes back to Binance

2026 is hitting hard with these hacks...

 

The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto.

First, Tether froze $1.5 billion in USDT.

Then Circle froze another $800 million in USDC.

At that point, it looked like the hacker’s money was trapped.

But apparently, he had already planned for that.

Instead of holding the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.

Then he walked away.

That’s where the story gets crazy.

Tether can freeze the USDT sitting in the wallet.

But it can’t freeze the ETH he already borrowed.

So now Aave is left holding frozen collateral, while the hacker is sitting on liquid ETH.

And unless the protocol can recover it somehow, he may not even need to pay the loan back.

Two companies froze billions of dollars in seconds.

But someone who understood how to use DeFi may have found a way around both of them.

Pretty insane when you think about it.

https://x.com/czesmaill/status/2115988477905080716?s=19

[OmegaStarScream]

So apparently this hacker knew these assets would get frozen, and to outsmart the system he used Defi to get Eth against the stolen coins on Aave...damn this happened so fast and was certainly two steps ahead , now the loss still goes back to Binance

2026 is hitting hard with these hacks...

-snip-

I was just going to ask about how credible this post is. I might be missing something here but If this is actually true, and Aave is holding the frozen funds then how come they're still saying everything is overcollateralized[1]? I understand they have a TVL of 15b dollars, but that's still a large sum of money.

[1] https://x.com/aave/status/2115937863162339637

[oll]

If I understand correctly, the Binance hacker wants to launder the stolen USDT. He can't simply store these tokens because Tether can lock them in any wallet.
To avoid being locked, the hacker uses the Aave platform, which allows borrowing against cryptocurrency. He deposits the stolen USDT on Aave as collateral and borrows Ethereum.
If Tether locks the USDT, the collateral on Aave becomes worthless, but the hacker retains the Ethereum he borrowed. That's how it seems.

I think that now the hacker will take this clean ETH to the same service where all the hackers with dirty ETH go. I think you know which service I'm talking about.

[Emjay24]

You all are calculating the SAFU like it’s transparent.. or where are you guys checking it  

According to them, they will publish a proof of reserves to reflect that use funds are safe. Let's wait for it then

Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

Link

They've also mentioned they'll resume operations in 48 hours. They'll likely be back soon, they're still tracing the exploit from the dev op's PC from which the exploit is suspected to originate from after being compromised.

[free-bit.co.in]

This is the same face that said 'user funds are SAFU.' He can say that everything is fine and under their control, but that face can't lie. It's not fine. Binance is burning right now.

This image was taken from an interview some time ago, where the presenter pressed him with the question of whether Binance could survive. He answered with "great confidence" and "enthusiasm".

He keeps acting like Binance is safe and secure from his tweets and often advises people to use the exchange. But there's no such thing as 100% safe in this industry. That platform he brags about won't be immune to hacking either.

Afaik CZ never said Binance can't get hacked. What he kept saying is that user funds are SAFU, and those are two very different things.

To be fair, Binance has paused withdrawals for now, but they've said more than once that user funds are safe and will be fully reimbursed. So imo it's way too early to be piling on CZ or Binance.

This could be the biggest  hack in crypto history , but given Binance's size and financial resources. I don't think they'll end up facing a serious crisis.

https://x.com/binance/status/2115981055043981791

[Karl_3000]

I woke up now it's $5.6B , op edit the title and update it over time. Only centralized exchange was left without hacking. I think centralized era will end soon.

@sergiorus, edit the amount hacked. The hack is up to $6.3 billion stolen now.

@Mahiyammahi, exchanges are often hacked. You mean only Binance has been the exchange that has not been hacked before? There are very few exchanges that have not been hacked before and Binance is not among them. Binance has been hacked before but compensated its users.

[AndrewWeb]

He got away with about 18.000 BTC and 200.000 ETH that's almost 2 billion dollars !

[Accardo]

Polymarket hacked? Do you have a link to that? How is it possible to compromise with EIP 7702?

The thread about polymarket hack is in the service discussion board. Yeah, the hackers gained access to a binance employee's laptop and deployed a delegation directing binance 14 to work on a malicious smart contract. They were able to generate and gain valid signatures for 50 consecutive nonces ranging from 18914775 - 18914824 to get the exact nonce for the hot wallet. One of the 50 signatures bundled to a single  EIP - 7702 type 4 transaction, matched the exact nonce for the hot wallet, so they grabbed the code behavior of the hot wallet using an External owned account.

[OmegaStarScream]

An update on the current situation:

Rough math:

$6.x b hack,
$3b frozen,
$1.x b SAFU fund

Gap is about $2b, we have $1.x billion in SPCX alone.
Remaining gap is (still painful, but) manageable

looks like Binance might need to sell their SpaceX shares to cover all of the losses here.

EDIT: According to one Binance's Co founders[1], this year's revenue should be sufficent to cover all losses without having to sell of any of their SPCX shares.

[1] https://x.com/heyibinance/status/2116101170079076558

[cygan]

mr. Karpeles has now launched a new website specifically to keep everyone up to date on the hack and everything that has happened since: https://www.tibane.net/research/binance-hack
at this link, you can read all the specific details about every step the hackers took. i highly recommend it!

[Somegory]

Don't worry guys, CZ says that funds are SAFU. 

I'm sorry but I am going to sound like a nasty bitch right now but I don't believe this, how much is Binance reserve itself? That 6 billion wouldn't drained them? If they can pay this big amount of money back they won't have anything left.

And what they did with October 2025 is making me even more curious right now, maybe Binance did this themselves? Who is going to question them anyway? No one.

Why now Binance? Why October again? How much do you guys have in the reserve already? Binance is one of the biggest exchanges with the trigger to pull any stunts like this one.

[Rikafip]

I'm sorry but I am going to sound like a nasty bitch right now but I don't believe this, how much is Binance reserve itself? That 6 billion wouldn't drained them? If they can pay this big amount of money back they won't have anything left.

The fact that the SAFU fund is worth ~$1 billion doesn't matter at all. What's important is trusting CZ when he says that the funds are safe and that people should keep their money on centralized exchanges (preferably Binance ofc).

[salad daging]

ZachXBT  suggested that the organization that attacked Binance this time and stole $6 billion worth of cryptocurrency was the General Intelligence Agency of the General Staff of the Korean People's Army, which controls the Lazarus group.

Like who are these Lazarus groups?
They remind me a book I read as a kind - a man called Gardoky. It was written that anywhere there is war and trouble, Gardoky is there. Is this applicable to Lazarus group? Anywhere there is hack and theft, Lazarus group must be directly or indirectly mentioned.

According to TRM Labs, the name of the group is TraderTraitor which is still related to the North Korean Lazarus Group, according to their analysis also TraderTraitor has an advanced infrastructure that can authorize Binance hot wallets.

As this is just a guess, they are also likely to continue to conduct onchian analysis to determine where the funds are going.
- https://clashreport.com/world/articles/north-korean-hackers-linked-to-record-6-36-billion-binance-theft-trm-labs-says-0wjiv79ndm9

[nikola22]

EDIT: According to one Binance's Co founders[1], this year's revenue should be sufficent to cover all losses without having to sell of any of their SPCX shares.

[1] https://x.com/heyibinance/status/2116101170079076558

there appears to be some tension between Zhao and Musk. Zhao asked Musk not to troll him, noting that the situation is difficult and hinted that he might sell SpaceX shares.

then Yi He stepped in to defuse the situation, writing that there is no need to sell the SpaceX shares on which Zhao remains bullish and Zhao decided to de-escalate.

it will be an interesting thread  :
https://x.com/heyibinance/status/2116101170079076558

[The Cryptovator]

The fact that the SAFU fund is worth ~$1 billion doesn't matter at all. What's important is trusting CZ when he says that the funds are safe and that people should keep their money on centralized exchanges (preferably Binance ofc).

As CZ said, users' funds are unaffected, which means nothing to worry about. But this reminds us how secure it is to store our funds in exchanges. Although this hack not only affected the whole market, it hurt me as well. I don’t have much funds on Binance; I won’t regret even lost it. But still don’t expect such an accident.

However, I appreciate how Binance handles such accidents. They often try to cover the losses, and users always stay unaffected. From our end, we have to be careful about using centralized exchanges. Not a large amount should be stored in the exchanges. So you can stay calm like me even during this kind of hacking.