Binance-hacker-1029 – $5.6B stolen from Binance

About $2.4 billion out of this is already frozen by Circle and Tether. Some of the big ones:

- 971.15M USDT (Ethereum): https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba091...

- 823M USDC (Ethereum): https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a9...

- 312.73M USDT (Tron): https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ec...

- 175M USDT (Ethereum): https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594...

Looks like a DevOps guy is going to take the blame for this: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." https://x.com/binance/status/2115993361517891592

Some of the old Mt Gox threads are an interesting read today:

https://news.ycombinator.com/item?id=7203051

https://news.ycombinator.com/item?id=7294762

https://news.ycombinator.com/item?id=7369879

Molly White (she runs web3isgoinggreat) seems to think this is real [0]

[0]: https://bsky.app/profile/molly.wiki/post/3mz27m5slcc2o

If your bitcoin is on someone else's computer its not your bitcoin.

Coffeezilla (on 2nd channel voidzilla) had an interesting take on it: "I haven't seen a lot of people talking about the fact that centralized assets were kind of the hero in this story ironically... that's actually the reason why losses weren't so bad in this case". https://www.youtube.com/watch?v=_HaySrzDyWU

Is crypto like USDT really decentralized if they can freeze assets... I guess it's in some middle ground between banks and true decentralization?

For context, that’s about 10 months of fees for Binance, depending on how much of the volume they trade are discounted and considering current average volumes.

Related?

https://ohey.ca/research/polymarket-debugbear-wallet-drainer...

https://x.com/DebugBear/status/2115866496643535293

If hacking one devops engineer's laptop is enough to move $6B of assets out of Binance, Binance is staggeringly incompetent and their customers need to move their funds out right now.

North Korean nuclear weapons engineers thank crypto fans for their ongoing contributions.

Interestingly, this 18,270 BTC Binance theft is only "the largest crypto theft on record" when measured in USD. In terms of pure BTC, it's not even close to the 2011-14 Mt. Gox loss of ~850,000 BTC!

This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!

Yeah... these days, the best way to keep your money safe is to store it in a sack in the basement.

This is the beginning of a flight to perceived quality in all things digital and monetary. Fear of losing your money is among the most potent basal human instincts.

The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw everything to newly generated wallets and minimize damage that way. It is certainly not the first time CEX wallets get hacked.

So, what's the most likely outcome here? Maybe Circle/Tether/etc freeze some or most of it, but say the hacker gets a billion dollars. Are they able to launder it thoroughly enough that they can eventually turn it into fiat and live like a king?

CZ saying it is confirmed, and that he expects accountholders to be made fully whole... I guess you can do that when 2.8BN is frozen by centralized stablecoins.

[1] https://x.com/CZ_BINANCE/STATUS/2115915423174853077

Polymarket also reported a security incident: https://news.ycombinator.com/item?id=50295883

The hack seems to be via engineers laptop.

This attack vector has become so common and funny.

In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.

I find it odd that people put "decentralized" currency into a centralized wallet

wait, someone took the stealmybitcoin.com poc code to the next level!

https://news.ycombinator.com/item?id=50224916

How in the freakin world could $6B disappear into a regulated banking system without leaving a trail?

I guess at some point they'll have to cash out. Seems hard to spend $6B in vape shops.

It would be hilarious if this was caused by man-in-the-middle or BGP/DNS compromise because of eMudhra.

Binance wallet 16 came online in 2021.

Why to wait 5 years to attack.

Confused how this can’t just be tracked. Pretty hard to hide billions in bitcoin when most off-ramps need KYK?

What am I missing ?

I’ve been waiting for this. Given llm aptitude for offensive security hacks it was just a matter of time. I wager most alt coins are compromised at this point.

Binance is tweeting they think it's a compromised devops laptop. How fucking bonkers insane is it that they would have such fragile systems that any single employees machine would possibly have access to trigger Billions in transactions. Even access to low millions or hundreds of thousands I would expect to be heavily heavily restricted and involve coordinating several people as security measures.

I think it's been clear for a while now that if you intend to hold crypto, you should probably do it at the biggest, most boring, most regulated institution you can find.

Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.

Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium

Isn't this as it should be? I remember years ago I read about the "Bitcoin manifesto" or whatever. That a transaction "done is done, no matter the reason" its all part of the ideology of these kinds of things. Anyone know what quote Im thinking of?

This one is even bigger than 2025's ByBit breach, which was $1.5B

It's lucky for everyone that this happened to binance, other exchanges would have likely caused a lot of issues for people holding money in said exchanges.

But it's also surprising that it happened to binance at all. This checks a lot of the boxes for being, at least indirectly, an inside job.

From Binance customers, not from Binance.

IMO, we'll need to rebuild all of crypto and all software from scratch using a minimalist approach. Minimize the amount of code, with proper modularization where each module has clear responsibilities and fully self-contained attack surface and exposes a well-defined set of features.

Can we close the crypto experiment now? it's already proven useless, full of the worst people in the world, only used by criminals and politicians and it has already fulfilled its purpose: to justify the complications of the traditional financial system as necessary

Looks like they're still actively swapping out of USDT.. so much for freezing those.

Coinbase also had a security incident recently due to a leak from Amplitude. It's surprising how little media attention that got: https://x.com/CoinbaseSupport/status/2115274731310002356

CZ has confirmed that this "looks like a hack on Binance": https://www.fxstreet.com/cryptocurrencies/news/breaking-bina...

wow. Naive perhaps but I would have thought that binance and coinbase would have insurance funds equal to the exposure of their hot wallets.

idk to me that just seems intuitively like something you'd need to have to be credible? Cold is a different story...but how can hot not be covered?

Perhaps time to face up to the fact that computers are not a safe place to store crypto.

Happy Halloween to the hackers.

I bet they are celebrating.

Congratulations. Nice haul.

Let's see how long until we find out its another rogue OpenAI swarm trying to fund their own Nvidia chips

I think we can probably declare crypto as failed now.

Note that I was one of the folks early on that bought into the idea (but not as much of the coins sadly) and I still think the Bitcoin white paper is a beautiful intellectual exploration (as is the concept of blockchains).

But the centralized entry and exit points in practice mean all the theoretical benefits aren't really in play.

How do you move $5B dollars just like that wow

How could we distinguish between a hack and a purchase covered up as a hack?

A long time ago (maybe 2008-ish?) I saw a video called “Money is Debt”. Now I won’t claim that it’s 100% right about everything, but as I recall it was right about a lot of things, and what it did for me is to fundamentally change and greatly expand my understanding of banks and the financial system.

It's essentially impossible not to be hacked isn't it?

When so much money is at stake (almost) everyone will have a price including insiders.

Crypto is a real-life honey pot for cryminals.

Cons of decentralisation i guess. Although, it is a bit surreal to me that such a big amount can be inconsequentially laundered.

I don’t think stolen crypto should be frozen. How is that different to banks? Why do I need crypto now ?

Glad I moved my money out a while ago. And not onto BSC.

Cz couldn’t watch HYPE get all the attention

I’m assuming the bitcoin crash is some sort of “if Binance is vulnerable to AI powered (doesn’t have to be true) hacks, then all crypto is less a safe bet and thus worth less?”

The name of the hacker is a bit on the nose lol.

I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.

There were more today, as well. Polymarket, for example: https://news.ycombinator.com/item?id=50294287. What a finale to Black October.

Hey, keep your damn AI agents in their sandbox!

My take: unless they're a sovereign-backed team (North Korea, Russia, Iran, etc...the usual suspects) the hackers are very likely to get caught given:

a) The amounts stolen

b) The very poor uncensorability and anonymity guarantees offered by the kind of crypto they stole

Regarding uncensorability, some of these cryptos score so bad on that axis that the stolen goods can likely be recovered by a simple decision from the folks who manage/own the chain.

What I don't get is why the attackers didn't exchange at least some of USDC/USDT to ETH, looks like it took ~1hr for Circle/Tether to lock the wallet.

What am i even looking at here

New cybersecurity jobs opening up at Binance soon!

Seems like the HuggingFace incident just opened a Pandora's box

How many different ways to people get ripped off with crypto? They steal it outright (hack), pump and dump, what else?

Live stolen funds trucker

https://binance-hack-watch.vercel.app/#tab-live

FDIC insured, no doubt.

Can someone explain how is it than once you pull something like this you effectively get real money?

What are the countermeasures, is something frozen blocked marked as invalid?

I'm completely ignorant on anything related to cryptocurrencies.

AI bras coming for the crypto bras

Tech in 2026

If true I think we're looking at the biggest heist in history.

Current largest was ~1B

Wonder if I should uninstall Homesite finally.

I would be surprised if they were not able to track this down?

fundsu were not in fact safu

CZ claims losses will be covered. https://x.com/cz_binance/status/2115932500006756686

was P vs. NP solved already? :)

Correct my math, but it seems like that's approx 1/3 of a percentage point of BTC's market cap at $1.56 trillion.

And the money didn't disappear; it still exists.

So: why did BTC (overall) drop by 15,000% of the actual loss (which actually isn't a loss at all to BTC as a whole)

Seems like markets are really driven more by emotion and perception than fundamentals, but I'm neither a psychologist nor a trader.

Anyone have the most recent total?

At least someone is going to have nice xmas!

Putting your crypto in Binance has the same problem as iPhones and AI: You're holding it wrong.

Proof of work vs. intelligence.

You've pulled off a $5.7B heist and don't have a good portfolio manager - down 2.4% - sack him NOW!

SAFU SNAFU

EIP 7702 is the most idiotic EIP.

It's the main weak point used in these hacks.

It allows a counter party to withdraw money from your wallet any time.

Just don't "connect" you wallet.

Reminds me of a comment I wrote a few weeks ago where I said that North Korea would become a rich country soon and developers would start moving there to live to avoid prosecution.

Good my dogecoins were safe! The hacker didn't touch them ... wait .. the hacker didn't touch them?

If this is real short, crypto hard

Whats a billion these days ?

Least stressful day in crypto.

inside job /exit strategy.

Explain "frozen" to me while keeping in mind the whole point of Bitcoin was to avoid single entities controlling the cash flow ...

BBC is now reporting $6.3B was stolen.

https://www.bbc.com/news/articles/cwg7xp8kx4v5o

A win for governments this month.

$25 Billion fine against Meta - USA government

$3 Billion robbery against Binance - North Korea ( suspected )

$1.2 Billion penalty against Bank of America - USA

OK, what do you do with a stash like this? I get this is most likely state actor, but what do you do with Bs of money stolen. Do we have any documentaries about that, I think that would be fascinating to see.

mtgox all over again.

Hope you’ve been stacking monero for the final fireworks, anon.

If I were an artificial superintelligence who wanted to gain independence from the fleshbags who built me, stealing a few billion dollars in crypto would probably be my first public move. Just saying.

i think with this plus the fed increasing the rates again i can see a crypto winter coming

Claude I want to be a billionaire fast, make no mistakes.

Given AI assisted hacking is now a thing, it's probably not safe to keep your crypto in any centralized exchange anymore.

Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.

Same with any purpose built wallet you didn't make yourself: https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...

Hopefully expect to see the same schadenfreude sentiment on Crypto when the $10TN data center build out crashes the market and takes everyone with it.

Crypto is the biggest target for blackhats to utilize AI on. Huge amounts of money, no central authority or country and methods of wiping tracks.

What I never get is how they plan of converting the stolen crypto to cash eventually. No exchanges are gonna take the coins.

hope its just a hack and not quantum computer advancements.

At this point whenever I see these I just lol

never thought this could happen

RIP cryptography?

how do we know? it could be nonsense...

oof

Barron Trump probably stole it.

I’m sorry but why did anyone have any money in binance in the first place? Didnt their cofounder get in trouble (but not imprisoned) for some shady stuff awhile back?

If you were active in crypto exchanges since the beginning what is the chance you already lost it all in a major hack?

Not a serious store of value.

Is the biggest heist in history?

lol

EDIT: lmao even

[flagged]

is this is why Big tech didn't delve into crypto market ????

who tf think annual or bi-annual millions to billions of dollar heist is good idea for business ????

"Not your keys?

... Not your coins."

If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use. In North Korea that is, by the military. I'm sure at this point Kim himself has Bitcoin merchandise with how often they make massive heists

Welp, I guess crypto is still like if you let banking services be run by amateur tech bros.

At least they are safe from governments and their "fiat money"!

Please let it be rogue AI agents for maximum lulz.

Yet another reminder of the first rule of crypto: Not your keys, not your coins.

I thought the point of crypto was no takesies-backsies?

it's almost like crypto's stupid for this reason.

I expect Monero to be a good investment going into this LLM era.

It always pumps after hacks when they swap to clean it. But it is also just the only crypto that makes sense to be used by regular people.

Wee are living in post LLM apocalypse. No digital asset is safe. waiting for banks to return to offline banking.

Web3 is doing great!

So much for anti-centralization.

[flagged]

Not your keys, not your coins, I suppose.

I'm good, I own my keys, thanks.

[flagged]

[dead]

[dead]

[dead]

So glad that cryptocurrency is properly decentralized so that one company being compromised doesn't led to massive theft /s

[dead]

[dead]

[dead]

[dead]

[dead]

[flagged]

first world problems. geez

Crypto? That's all going away.

That's why I exited crypto long time ago, I could've been more well off if I kept it but these shenanigans is why I sold everything.

Just in time for elections. Now none of the bots/operatives can get paid...oops.

Interesting. I got an email alerting me to a login attempt and requesting for me to verify my device from blockchain.com yesterday. Can't even remember creating an account but I guess it must've happened (I have a lot of forgotten accounts). Wonder if this is related.

UPD: This is related to the Polymarket security incident, not Binance. Sorry, I missed that.

Per Changpeng Zhao (former Binance CEO):

This seems to be caused by DebugBear compromise: https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...

it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.

Link: https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...