On October 29th (between 20:05 and 20:24 UTC), Binance experienced the largest hack in cryptocurrency history, with approximately $6 billion drained from its hot wallets. The attack began with the compromise of a DevOps engineer’s laptop, allowing attackers to access a service container in Binance’s backend. On the Ethereum network, the attackers utilized EIP-7702 to transform hot wallets into “automatic sweepers” that instantly forwarded funds to the hackers. While blockchain intelligence firms attribute the attack to North Korea’s Lazarus Group (specifically the Trader-Treater unit), the theft was partially mitigated by stablecoin issuers (Tether, Circle, and Ripple) who froze between $2.5 and $3 billion of the stolen assets. Binance has stated that user funds are safe and will be covered by the SAFU fund and corporate reserves.
Historic Context
This event is unprecedented in scale, dwarfing the previous record of $1.5 billion held by Bybit. It represents a major security breach at the center of the crypto market, targeting the largest exchange which holds roughly $160 billion in custody for over 300 million users.
Facts and Persons
Key Persons
- CZ: Former CEO of Binance (confirmed the exploit on X).
- EHA: Co-CEO of Binance (confirmed user funds were safe).
- Paolo Arduino: CEO of Tether (coordinated the freeze of $1.6B in USDT).
- Jeremy Allaire: CEO of Circle (coordinated the freeze of $800M+ in USDC).
- Guy: The narrator/investigator from Coin Bureau.
Key Facts
- Amount Lost: ~$6 billion.
- Amount Frozen: ~$2.5 to $3 billion.
- Attribution: Attributed by TRM Labs, Blockaide, Elliptic, and Chainalysis to North Korea’s Lazarus Group (Trader-Treater unit).
- Market Impact: Bitcoin (BTC) dropped from ~$81k to a low of ~$76.4k.
- Liquidations: ~$1.5 billion in derivatives positions liquidated across 240k accounts.
Technical Mechanisms Involved
- Compromised Endpoint: The entry point was a single laptop of a DevOps engineer.
- Service Container Exploitation: Attackers used access to a backend service container to initiate unauthorized withdrawals.
- EIP-7702: A technical upgrade to Ethereum that allows a standard account to temporarily function as a smart contract. Attackers used this to “reprogram” the hot wallet into an automatic sweeper.
- Hot Wallet vs. Cold Storage: The attack was limited to internet-connected hot wallets; master keys and cold storage remained secure.
- Stablecoin Blacklisting: The ability of centralized issuers to blacklist addresses, effectively freezing stolen USDT, USDC, and RL-USD.
Consequences
- Financial Loss: A $6 billion hit to Binance, though mitigated by freezes and the SAFU (Secure Asset Fund for Users) reserve.
- Market Volatility: Triggered a massive deleveraging event in the crypto market, breaking the long-standing $80k support level for Bitcoin.
- Operational Halt: Binance was forced to pause all global deposits and withdrawals temporarily.
- Security Realization: Highlighted the vulnerability of DevOps infrastructure and the critical role of stablecoin issuers in recovering stolen funds.
