What a day yesterday was for crypto.
If you missed it, Thursday morning the parent company of the New York Stock Exchange announced an investment in Trade[XYZ], the company responsible for Hyperliquid’s equity perpetuals, alongside plans to bring perps stateside. Hours later, in an event dripping with uncanny irony, Binance, the world’s largest crypto exchange, and arguably Hyperliquid’s top rival, suffered the largest crypto hack on record and, by some accounts, the largest theft in history.
The exchange estimates the damage at $6.3 billion, more than four times the amount stolen in the infamous Bybit hack last year.
Binance insists that customer funds are safe and that it will cover the losses. But with billions missing, withdrawals suspended, and questions about how it happened, the concern is obvious: if Binance isn’t safe, what is?
Let’s break down exactly what we know as of now, and where we go from here.
— (@)
According to Binance’s preliminary investigation released late last night, the exchange initially traced the attack to a compromised DevOps engineer’s laptop, which apparently gave the attacker access to internal systems that could authorize withdrawals. How the laptop was compromised remains unclear, and Binance says additional points of compromise have been found.
— (@)
Co-CEO Richard Teng has since explained that the operation involved multiple attackers, who also used a self-destruct mechanism to erase evidence as they went.
Well, if they authorized withdrawals, they must have gotten private keys, right? It doesn’t look like that.
On Ethereum, security firm TRM Labs found the attacker had valid, signed authorizations under an Ethereum feature called EIP-7702, allowing a Binance wallet to hand control to malicious code. According to Teng, this happened without passing Binance’s normal approval checks. Effectively, they could tell the wallet to send funds elsewhere without necessarily stealing its private key. How those signatures were obtained remains unknown.
But that explains Ethereum only. Nine other blockchains, including Bitcoin and Solana, were also drained through normally signed transactions, suggesting a broader compromise of Binance’s systems for approving withdrawals, according to TRM.
Not good.
As one could have suspected, it looks like North Korea’s behind the attack.
TRM and Chainalysis have linked the attack to North Korea’s TraderTraitor group, responsible for last year’s $1.5 billion Bybit hack. Binance has not confirmed the attackers’ identities and is reportedly working with the FBI and U.S. Secret Service, alongside other law enforcement agencies around the world.
Enjoying this article?
Subscribe to Bankless or sign in
— (@)
Deposits are operating normally, but withdrawals on the exchange remain paused during a security overhaul, though Binance expects them to resume by Sunday (fingers crossed). It’s reviewing everything from employee devices and cloud systems to private-key management and transaction-signing procedures before bringing withdrawals back online.
Industry partners including Tether and Circle have helped freeze approximately $3 billion in affected assets, per Binance. That’s encouraging, though frozen funds aren’t necessarily recovered funds. Other stolen assets, like bitcoin and ether, have no issuer that can freeze them, though Aave temporarily froze new deposits and borrowing across its markets to prevent further misuse, before lifting the freeze Friday morning.
The immediate concern, of course, is whether Binance can make its customers whole. It promises to cover all losses using its emergency Secure Asset Fund for Users (SAFU) and corporate cash. Although SAFU holds around $1 billion, Binance said it has earmarked more than $6.34 billion, including $5 billion already held in the affected tokens, and is buying the rest.
— (@)
That’s progress, but until Binance can show that customer balances are fully backed again, it’s probably too early to jump for joy.
What may bring comfort (or more concern depending on who you are) is knowing that this isn’t Binance’s first major security incident.
Back in 2019, hackers stole 7,000 BTC from the exchange, a loss Binance covered in full through SAFU.
Obviously, this incident is on an entirely different scale, and it’s come at a rough time.
For an industry still working to earn the trust of mainstream investors and institutions, watching billions disappear from its largest exchange is hardly reassuring. Especially on the day Wall Street announced another major step toward bringing Hyperliquid stateside.
But the question hanging over this incident is a difficult one: if even Binance, with its enormous resources and security infrastructure, is vulnerable to an attack of this magnitude, where exactly are users supposed to feel safe? It’s a valid concern, though one that stings the most in the eye of the storm.
Crypto was already navigating an increasingly difficult market environment, with pressure on technology stocks, broader economic uncertainty, and the U.S. midterm elections approaching. All the while, it had held up impressively, until the Binance hack added another reason for investors to sell.
Still, BTC and many of this cycle’s popular coins are down only single digits. Over in tech land, Intel’s down nearly 30% on the day. For anyone with cash on the sidelines, that kind of relative strength is worth watching.
— (@)
I don’t think this is something crypto can’t recover from. We’ve survived major exchange collapses, exploits, and plenty of other crises before. But it could mean more pain, or at least a pause.
For now, Binance’s ability to honor its commitments matters more than anything else. Replenishing reserves and explaining what happened are essential to restoring confidence. I’d give it the weekend to see what transpires, particularly whether Binance makes good on its promise to reimburse users.
