How Binance Was HACKED For $6 Billion

Massive Outflows from Binance Hot Wallets [20:05]

• On-chain trackers began flagging unusual outflows from Binance's internet-connected hot wallets.
• The Ethereum hot wallet, Binance 14, was emptied in a single transaction worth around $2.5 billion.
• More hot wallets across various blockchains, including Bitcoin and Tron, were subsequently drained.

  "And by the time withdrawals were switched off, $6 billion had left the biggest exchange in crypto."

Binance Confirms Exploit and Halts Operations [20:24]

• Former CEO CZ confirmed on X that Binance had been exploited, while Co-CEO EHA assured user funds were safe.
• Binance globally paused all deposits and withdrawals.
• Binance.us confirmed it was unaffected as it operates as a separate entity.

  "Former CEO CZ posted on X that it, quote, looks like a hack on Binance, and later confirmed that Binance had indeed been exploited."

Attackers Exploited DevOps Laptop and Ethereum Upgrade [20:41]

• The attackers gained access by compromising a single laptop belonging to a DevOps engineer.
• They exploited a service container to initiate unauthorized withdrawals directly from hot wallets.
• On Ethereum, an upgrade called EIP 7702 was used to temporarily turn a hot wallet into an automatic sweeper.

  "According to Binance's initial findings, it started with the compromising of a single laptop belonging to one of its DevOps engineers..."

Lazarus Group Suspected; Scale of Theft Unprecedented [20:41]

• Blockchain intelligence firms attribute the attack to North Korea's Lazarus Group.
• The $6 billion stolen is roughly four times larger than the previous record hack attributed to Bybit.
• Binance, with over 300 million users and $160 billion in custody, is a significant target.

  "Blockchain intelligence firms, including TRM Labs, Blockade, Elliptic, and Chainalysis attribute the attack to North Korea's trader-traitor unit, part of what's known as the Lazarus Group."

Billions in Stolen Funds Frozen by Industry [20:41]

• Within hours, Tether froze $1.6 billion in USDT, and Circle froze over $800 million in USDC.
• Ripple froze about $200 million of its RLUSD, and Aave paused lending pools.
• Approximately $2.5 to $3 billion, or 40-50% of the stolen crypto, was frozen.

  "Add it all up, and somewhere between $2.5 and $3 billion worth of crypto was frozen within hours."

Bitcoin Price Plummets Below $80k; Derivatives Liquidated [20:41]

• Bitcoin, which had been trading around $81k, fell below $80k as the drain began.
• Approximately $1.5 billion in derivatives positions were liquidated, with long positions heavily affected.
• BNB slid 5-8%, and Ethereum fell around 5% to two-month lows.

  "According to Coinglass data, roughly $1.5 billion in derivatives positions were liquidated over 24 hours, across about 240,000 accounts."

Partial Recovery, but Significant Funds Remain Unaccounted For [20:41]

• While billions were frozen, over $570 million in ETH has moved through Tornado Cash and other mixers.
• The freeze significantly reduced the attacker's gains but did not result in a full recovery.
• Binance has stated it will cover all user losses from its SAFU fund and corporate balance sheet.

  "So, the freeze didn't undo the hack entirely, but it did cut the attacker's winnings roughly in half."

Market Recovery and Future Outlook [20:41]

• Bitcoin saw a relief bounce to around $78.5k after the leverage wipeout but remained below the $80k floor.
• The incident highlights the industry's resilience, with no customer losses and damage being managed.
• The recovery of Bitcoin above $80k is seen as a potential indicator of future market strength.

  "And at the end of the day, that is the most important thing."