Binance遭黑客攻击损失60亿美元系北韩 Lazarus Group所为

On Thursday evening, one hot wallet after another on Binance started to empty. Crypto Twitter Julie went into meltdown as more and more funds continued to drain from those wallets. And by the time withdrawals were switched off, $6 billion had left the biggest exchange in crypto. No hack in history has come anywhere near it. And while all of that was going on, Bitcoin finally lost the floor it had been clinging to for weeks.

So, how does the most heavily defended exchange in crypto lose $6 billion in a single evening? Well, to find out, we'll look at how the attackers got in, what Binance did next, how much has already been frozen, and what it all did to Bitcoin. My name is Guy, and you're watching the Coin Bureau. Okay, what the hell just happened? Well, between 2005 and 2024 UTC on the 29th of October, onchain trackers like Arkham, look on Chain and Peek Shield started flagging unusual outflows from Binance hot wallets.

These are the exchanges internet connected wallets used to process deposits and withdrawals. Then at 2024, the Ethereum hot wallet labeled Binance 14 was emptied in a single transaction and that one transaction was worth around $2.5 billion. Seconds later, Binance 16 followed. From around 2041, the sweep widened. Hot wallets on Bitcoin, Tron, Arbitum, Optimism, Avalanche, and according to some trackers, Salana were drained as well. stable coins, BTC, ETH, and a load of other tokens were all taken.

Etherscan then gave the receiving address a brand new label, Binance Hot Wallet Exploter. Then Binance's former and current leadership went public. Former CEO CZ posted on X that it quote does look like a hack on Binance and later confirmed that Binance had indeed been exploited. Co-CEO E-Ha then posted that user funds were safe and Binance paused deposits and withdrawals globally. Meanwhile, Binance US, which runs as a separate company, confirmed it was unaffected.

So, in just one evening, the biggest exchange in crypto went from business as usual to a full halt. But how did the attackers actually get past the best funded security operation in the industry? Well, they didn't break down the front door. According to Binance's initial findings, it started with the compromising of a single laptop belonging to one of its DevOps engineers, the people who look after the company's internal infrastructure.

From there, the attackers gained access to what's known as a service container. That's part of Binance's back-end infrastructure, which the attackers apparently exploited to initiate unauthorized withdrawals directly from the exchanges hot wallets. On Ethereum, this was done through EIP7702, an upgrade that lets an ordinary wallet temporarily behave like a smart contract. The attackers used it to turn a Binance hot wallet into an automatic sweeper, one that drained the balance and forwarded any new deposits onto them as well.

The attacker had effectively reprogrammed the wallet so that a single operator could drain it. Now, to be clear, Binance says there's no sign its cold storage or master keys were touched, and exactly how those transactions were authorized is still being pieced together. And as for who is behind it, well, blockchain intelligence firms including TRM Labs, Blockade, Elliptic, and Chain Analysis attribute the attack to North Korea's Trader Trader Unit, part of what's known as the Lazarus Group.

Yep, it is. You won't be surprised to hear the usual suspects. As I make this video, neither Binance nor law enforcement has confirmed that. But considering the history there, it's a very reasonable bet to make. So then just how big is this hack? Well, for a sense of scale, the previous record belonged to Bybit. In February last year, attackers walked off with roughly $1.5 billion in crypto. And that one was also attributed to, yep, North Korea.

This one though is roughly four times larger. But it's not only the size of the theft. The target is particularly significant, too. Binance has more than 300 million users and holds roughly 160 billion in custody. It's where a huge share of the market's liquidity is found and where much of crypto's trading actually happens. So this was an operation targeting the very center of crypto which of course begs the question that those 300 million users and many others are now asking.

What happens to the stolen funds? Well, Binance has said that user funds are safe and that it will cover all losses drawing on its Safu fund and its own corporate balance sheet. Safu is the secure asset fund for users, an emergency reserve Binance set up for exactly this kind of situation. Now, for context, roughly $6 billion against roughly $160 billion in custody works out at around 4%. So, it's painful, but for a company this size, it isn't fatal.

But there's another important bit of detail to consider here. Within hours, the industry started freezing the stolen funds on chain. Tether, led by CEO Paulo Arduino, froze $1.6 billion dollars in USDT across Ethereum and Tron. Circle froze more than 800 million in USDC with CEO Jeremy Alair saying it was working with law enforcement. Meanwhile, Ripple froze about $200 million of its RLUSD stable coin, and Ave paused affected lending pools.

That stopped the attacker from depositing stolen tokens as collateral and borrowing ETH against them. ETH that no issuer can freeze. Now, here's why the freeze works at all. Stable coins are issued by companies that control the token contracts. And if the issuer blacklists an address, the tokens in it simply stop moving. Add it all up and somewhere between 2.5 and $3 billion worth of crypto was frozen within hours. That's 40 to 50% of the entire hall locked up before the attacker could do much with it.

For an industry that usually watches stolen funds vanish into mixers, that's not a bad outcome. But of course, it's far from a full recovery. More than $570 million worth of ETH, which can't be frozen, has already started moving through Tornado Cash, Uniswap, and Crosschain bridges. So, the freeze didn't undo the hack entirely, but it did cut the attackers's winnings roughly in half. Now, while all of this was going on, the market was, of course, busy reacting to it.

So, what did all of this actually do to Bitcoin's price? Well, for weeks, Bitcoin had been chopping around the 80K level with buyers defending it every time it dipped and resistance capping it in the low to mid 80ks. And when the drain began on Thursday evening, BTC was sitting at around 81K. Within about an hour, it was below 80K. And once that floor gave way, the leverage stacked on top of it unwound fast. According to Coinlass data, roughly $1.5 billion in derivatives positions were liquidated over 24 hours across about $240,000 accounts.

Close to 90% of those were longs with the worst single hour flushing around $600 million. Not exactly the bounce off support those traders were positioned for. Unsurprisingly, of course, BNB took a hit, too. Depending on where you measure from, it slid by 5 to 8% to a low of around $680, although it then proceeded to claw back above $700. Now, all things considered, that isn't terrible considering we're looking at the largest exchange theft on record.

Meanwhile, Ethereum fell around 5% down to two-month lows, but BTC was the big one, printing a low of about 76.4K, its weakest level since midepptember. As I make this video, Bitcoin is trading at around 78.5K, a relief bounce after that massive leverage wipeout, but still stuck below the floor the bulls spent weeks defending. So, it took the biggest theft in crypto history to finally push Bitcoin below that 80K floor.

But the recovery it's managed since then is a reason for optimism. And if the worst of the bad news is behind us, there's every chance Bitcoin reclaims that level before too long. But until it does, there's probably no need to be a hero and jump into the market. Stay calm, stay safe, and trust that crypto will bounce back from this. We can also take solace from the