BRIEF
Binance lost $6.3 billion in about 20 minutes, the largest crypto theft on record.
Inca Digital traced the thefts to Binance authorizations signed by compromised machines.
The FBI points to North Korea's Lazarus Group as the culprit.
Binance says it and stablecoin issuers froze about $2.85 billion of it. Binance says it will cover the rest.
Concept Artist: Alan Zhou / Creative Studio: Sum of Parts for Zero Knowledge
How did it happen?
Good morning,
Twenty minutes.
Six billion dollars.
Mt. Gox got hit in 2013. Bybit got hit last year. Now the biggest exchange in the world.
Grumping,
Austin Campbell
Teaching DeFi at NYU Stern
Bridging TradFi at Zero Knowledge
P.S. The Zero Knowledge team works hard to produce this for you.
If you like it, share it with your colleagues.
🏹 BACK UP
WTF IS A HOT WALLET?
A hot wallet is the internet-connected wallet an exchange uses to process everyday withdrawals. It is convenient because it is always on, and risky for the same reason.
$1.47B
WTF IS THE LAZARUS GROUP?
The Lazarus Group is the North Korean state-linked hacking operation behind a string of record crypto thefts. The FBI ties the Binance attack to TraderTraitor, a North Korean effort generally seen as part of or parallel to Lazarus.
$1.5B
⏳ BREAKDOWN : LIGHTS OUT
It started with a fake job interview. The cleanup is still running.
JUNE
An engineer on Binance's wallet team downloads a fake version of a developer tool. Binance says it caught and fixed the problem.
LATER
A second engineer is contacted through a job-hunting platform. In a second "interview," he is told to download an "assignment" that’s actually malware. That gives the hackers their foothold and, eventually, signing privileges.
OCT 29
4:05 p.m. ET: the attack starts on the XRP Ledger, then spreads to Ethereum and Bitcoin. One transfer tops $2.5 billion. The Ethereum drain runs through EIP-7702, an upgrade that lets a smart contract control a wallet, so it happens on-chain, outside Binance's own systems.
OCT 29
Binance pauses withdrawals and works with Tether, Circle and others to freeze funds. Binance says the freezes stop about $2.85 billion; Inca puts it near $3 billion.
OCT 31
Binance says it has replenished 98% of the losses.
NOV 1
Withdrawals resume, starting with Ethereum, USDT, USDC and some tokens on Binance's own chain.
NOV 3
Binance publishes an incident report. Customers have pulled about $5 billion so far, roughly 3.5% of Binance’s assets.
NEXT
The hackers are laundering the rest, reportedly using AI agents to create thousands of circular transactions, per Chainalysis and other analysts.
ZERO INSIGHTS
Binance Lost $6.3B in 20 mins. How?
“Multiple engineers in security-critical roles downloaded and ran insecure software on work machines. One employee fell for a social-engineering ‘job interview’ scam that has been well-known in the crypto industry for close to half a decade.”
🎭 BUSTED
THEY SAY
Binance has policies against outside software downloads and against employees keeping public profiles on job boards.
BUT ACTUALLY
The policies were not enforced. Engineers in security-critical roles ran unvetted software on work machines, and one was reached by a fake job interview. Binance's announced fixes include an independent review, more AI prevention and more security research funding - but no new employee training.
$2.85B
The "interview" attack vector has been well-known in cryptocurrency circles since at least 2022. This is something Binance should have been more prepared for.
💰 BAG HOLDERS
WINNERS
North Korea's Lazarus Group, which kept more than $3 billion after the freezes.
LOSERS
Binance, which eats the loss and the reputational hit.
Binance's market share, down from as much as 51% of spot volume in August to 42% from October 28 to November 3.
Crypto, as the space still hasn’t come up with a serious answer to these hacks.
ZERO OUT
Binance is the biggest exchange in crypto, and it just lost the biggest haul ever stolen.
BEST CASE
The frozen funds are fully recovered and the industry learns from it.
WORST CASE
Customers keep pulling money out and Binance's reputation takes lasting damage.
1️⃣ One exchange was a single point of failure for billions. That is on the company and its security, not on its customers.
2️⃣ Freezes stopped about $2.85 billion, but only on assets someone can freeze. The on-chain Ethereum drain was out of reach.
3️⃣ Bybit in 2025, Binance in 2026. The same suspect keeps winning, and experts believe the money helps fund North Korea's ballistic missile program.
While Binance claims it defended against 57 attacks before getting hit once, the bigger problem is that the attacker has no disincentive to stop trying. Until there is effective defense and deterrence, the hacks will continue.
Does crypto have an answer for this? As of yet, no.
ZERO INSIDER
Discussed this story: Binance losing $6.3 billion in ~20mins on Unchained's Bits + Bips, and it wound up on Yahoo Finance.
David spoke with the Telegraph about Effective Altruism moving into British politics, and he's started this week's ZK livestream on Anthropic's numbers ahead of the IPO.
Shirley’s creative team tried for a serious post & ended up with a sh*tpost
