The Binance Hack | Explained.

The Largest Crypto Heist Ever [0:05]

• A massive cryptocurrency heist has resulted in the loss of $5.5 to $5.8 billion.
• This event is being called the largest cryptocurrency heist ever recorded.

• "5.5 to 5.8 billion dollars worth of cryptocurrency are gone in a major heist. The largest cryptocurrency heist ever."

Human Engineering Suspected, Not AI [0:15]

• The heist may not be related to AI hacks or cryptocurrency failures, but rather human engineering.
• The attackers might have gained access through a compromised laptop.

• "And it might have literally nothing to do with an AI hack or a failure in cryptocurrency. Instead, it might have everything to do with the North Koreans and a laptop."

Breach of Binance Wallets and Fund Movement [1:17]

• An attacker gained access to Binance's number 14 wallet, an Ethereum hot wallet, around 1:20 p.m. Pacific time.
• The exploit used a trick within Ethereum Improvement Protocol 7702 to extract funds.

• "And they used a trick inside of the Ethereum Improvement Protocol 7702."

• Access to the laptop granted the attacker access to various cryptocurrencies beyond Ethereum, including Tron, Pepe, Aave, USDC, Tether, and Bitcoin.

Hot Wallets and Automatic Signing [2:35]

• The hacked wallets were hot wallets, connected to the internet, which are common at brokerages for faster transactions.
• Automatic signing protocols on compromised laptops can facilitate rapid fund transfers.

• "These were hot wallets that got hacked. There were multiple of them. Hot wallets are really common at brokerages because if you are going to use a brokerage to transact crypto and you're like, hey, I'm going to pop in, I'm going to sell some crypto, you don't want to wait two or three days for a human to approve every transaction."

• Gaining access to the engineer's laptop was critical due to easier internal legitimization of transactions.

Speed and Scale of the Theft [5:40]

• Approximately $2.5 billion was moved out of the wallet within four minutes of the breach.
• This initial $2.5 billion represented about 40% of the total stolen amount.

• "Once this wallet got hacked, we ended up seeing about $2.5 billion leave the wallet within four minutes, which is insanely fast."

• Subsequent sweeps over 80 minutes drained an additional $200 million as new funds entered the compromised wallets.

The Human Engineering Attack [8:23]

• The attackers likely used social trickery to compromise an engineer's laptop, leading to the theft of approximately $3 billion.
• Binance had previously announced that North Koreans were attempting to breach their systems.

• "Well, this is where we get into the human-engineered hack. Because right now, these people probably, through human engineering, social trickery, made off with somewhere between 3 to 3.2 billion dollars."

• The movements of Bitcoin, initially thought to be internal transfers, were confirmed as malicious.

Exploiting Ethereum Protocol 7702 [13:00]

• Ethereum was uniquely targeted using a "fishnet" or "authentication spray" technique within the 7702 protocol.
• This method allowed attackers to test multiple authorization numbers simultaneously, increasing the chance of a successful transaction.

• "Ethereum 7702 allows you to do, like, 50 authorizations at the same time. And so, because this is a publicly broadcasting chain, an attacker can see, oh, okay, we're roughly in this range, even though we're moving every second to another number."

• This technique was necessary for extracting Ethereum, while other funds could be accessed directly from the compromised laptop.

Fund Freezing and Evasion Tactics [15:30]

• Alarm bells began ringing within minutes, with various security firms flagging the activity.
• Tether and Circle froze approximately $1.5 billion and other funds, respectively, about 40 minutes to an hour after the attack began.

• "Peck Shield at 1.55 p.m., Tether froze $1.5 billion at around 9.01, between 9.01 and 9.25. So, roughly 40 minutes to an hour after the attack began."

• Attackers attempted to evade detection by dumping altcoins like Uni and Pepe for Ethereum and leveraging stolen collateral on Aave to borrow more funds before markets were frozen.