Binance Hack: Why Withdrawals Froze for 2.5 Days After $6.3B Loss

So worryingly, yes, this laptop was able to start the process of carrying out this huge hack, but ultimately we're looking at a human and some just one laptop that started it all up because someone's clicked on a link that has downloaded this huge malware. One laptop, that's where Binance itself says it may have started. And by the time it was over, about $6.3 billion had gone out of the biggest crypto exchange in the world. Most of it in about 20 minutes in one night. It's the largest crypto theft ever recorded.

Roughly four times the old record. But here's the part that matters. If you own any crypto at all, for about 2 and 1/2 days after that, Binance users couldn't withdraw. More than 300 million registered accounts and the withdraw button switched off across the board. Binance has since replaced nearly all of it, but for that whole stretch, nobody outside knew it would, and all those coins weren't really theirs to move.

So, I'm going to take you through it minute by minute. How they got in, why almost half the money got stopped within hours while the rest may never come back, who the investigators think did it, and the one question it leaves anyone with coins sat on an exchange. Stick with me to the end because that last bit is the one most people skip.

[music]

First, one idea you need for the rest of this to make sense. An exchange like Binance doesn't keep your coins in a box with your name on it. It pulls everyone's together. Most of it is meant to sit in what's called a cold storage. Think of it as the vault.

The keys are kept offline. It's slow to move and it's very hard to steal from. But most people are buying, selling, and withdrawing all day. So, an exchange also keeps some coins in hot wallets. Those are always online, ready to pay out in seconds.

A hot wallet is meant to be a cash register, not the vault. Now, hold on to that because on Thursday, the 29th of October, one of Binance's cash registers was holding billions. And Binance has been robbed before. Back in May 2019, hackers took about 7,000 Bitcoin, around $40 million at the time. Binance covered it from an emergency fund it calls SAFU, short for secure asset fund for users.

This one was about $150 times bigger. According to the blockchain investigators at TRM Labs, this didn't start on Thursday. On the Wednesday morning, a wallet received a few small payments through Tornado Cash, a service built to hide where money's come from. That wallet became the attacker's remote control. Then the attacker built a small program, a sweeper designed to empty a wallet in one go, and it would only take orders from that remote control.

They tested it on two wallets, then a full rehearsal on a third, and then TRM says they waited about 4 hours. Nobody said why. Here's how Bloomberg's digital finance reporter Emmany Nicole summed up what Binance was saying the next morning.

So far, we don't know a ton. Uh, from what we've heard from Binance, there was a targeted attack made on an employees laptop which enabled the attacker to gain access to some parts of Binance's internal architecture. And through that, they were able to siphon a large amount of funds. Right now, the confirmed amount is around $6 billion worth of crypto.

Some parts of Binance internal architecture. But back to Thursday night because that's when it moved fast. Just after 8 in the evening UK time, about 4 in the afternoon in New York, five Binance wallets on the XRP ledger started sending. In about 4 minutes, 233 million XRP, nearly 300 million goes to one address. Minutes later, Binance wallets on Salana and Optimism are being emptied, too.

Then at about 20 8, Binance's Bitcoin Hot Wallet sends more than $18,000 Bitcoin. That's about 1 and a half billion in one go. Within a couple of minutes, Tron over $600 million in the stable coin USDT. And here's the strange bit. None of this looked like a break-in.

These were properly signed, valid withdrawals. As far as each blockchain could tell, Binance was simply paying someone. Then Ethereum. Since last year, Ethereum has had a feature known by its code number 7702. It lets an ordinary wallet sign a note that says, "From now on, this program runs my account." It was built to make wallets easier to use.

But a note like that has to carry the wallet's own signature. So, whoever did this had already got far enough inside Binance's system to get those signatures. The attacker sent one transaction to Binance's main Ethereum hot wallet carrying 50 of those notes. Each one handing the wallet over to their sweeper. So why 50?

Every transaction a wallet sends gets a number in order. Binance's wallet was busy handling everyone's withdrawal. So its number kept climbing. The attacker couldn't know which number it would be on at that exact moment. So they brought a note for each of the next 50.

One of them was bound to fit and one did. And 3 minutes later, the sweeper moved. One transaction, $167,000 ETH, another $1.6 billion in USDT, and dozens of other tokens. All of it. Most of the money left Binance in about 20 minutes.

To be clear, Ethereum itself wasn't hacked. The attacker used one of its normal features as the gateway car. Now, the attacker had a problem. A big chunk of what they taken was stable coins. crypto dollars like USDT and USDC and those are different. Here's Coin Bureau the next day on why.

Now, here's why the freeze works at all. Stable coins are issued by companies that control the token contracts. And if the issuer blacklists an address, the tokens in it simply stop moving. Simply stop moving. So, the race was on.

According to TRM, the attacker started dumping stolen USDT for ETH as fast as they could, even taking a loss of more than 10% just to get out before the freeze. They put another 60 million into the lending app to borrow ETH against it. 37 minutes after the main sweep, Tether froze nearly a billion dollars of USDT in the attacker's main wallet. Three minutes after that, Circle froze over 800 million in USDC working with law enforcement. A froze its markets.

Then Ripple froze its stablecoin RLUSD and World Liberty Financial froze its own. And just after midnight, the Security Council that oversees the Arbiterum network forced about $30 million out of the attacker's wallet. By the early hours, Binance was saying about $3 billion had frozen. Crypto is meant to be decentralized. Yet nearly half of what was stolen got stopped because a handful of companies pressed a freeze button.

And here's the twist. The coins that could be stopped mostly were. The coins built so that nobody can ever stop them. The Bitcoin and the ETH, those got away. TRM says the Bitcoin was split into chunks.

Some of a thousand coins, some of a hundred. No company on Earth can freeze those. Now, the detail that matters the most. That night, Binance switched off withdrawals. You'd think that would have ended it.

Well, it didn't. The sweeper didn't need Binance's withdrawal system. It already controlled the wallet. So, every time fresh money landed in that hot wallet, the sweeper took it. TRM logged at least six more sweeps after the main one.

The last one it recorded came 4 minutes to midnight UK time, more than 3 and 1/2 hours after the main sweep. Meanwhile, a second wave had hit Binance wallets on Avalanche and Polygon 2. Just after 2 in the morning, Binance gave its first explanation. It said the incident may have involved a compromised laptop belonging to one of its engineers and that it had found no evidence any wallet's private keys had leaked. By Friday morning, it had widened that.

Richard Teng said this was a more complex attack process, not a single one-click action, and Binance said it had found additional points of breach. Binance itself didn't name anyone at first. The investigators did. Here's how the national desk put it on the Friday morning.

We're calling this Jan the largest crypto theft on record and it's being attributed to North Korea's top hacking unit which is called trader traitor. It's a play on words for someone who trades financially and trader someone who betrays their country.

Trader traitor. TRM lads says it's made that call with high confidence. The boss of chain analysis said it was likely the same group. And on Saturday, the FBI said it too. It named Trade Trader and said North Korean actors were converting the stolen money mostly into ETH.

And the group's playbook is well known by now. In February last year, the exchange Bybit lost about $1.5 billion dollars. And the FBI blamed Trade Trader for that one as well. Several of the biggest crypto heists of the last few years didn't start with broken code. They started with a person.

Even President Trump was asked about it. At Marielago on Saturday, he told reporters, "We're looking into it. I'm not worried." He said he didn't know if North Korea was behind it, but if it was, he talked to them about it. But the thief wasn't the only story that night. The thief got the headlines.

But the thing every Binance user felt that withdrawal button was going gray. Binance had suspended withdrawals. And here's Emina Cole again on Bloomberg the next morning on why that matters. Even when a company has the money to give out, it does depend a lot on how much customers do rush to that front door trying to withdraw their money and exactly how liquid everything is behind the scenes.

That front door. Now, did you catch that? The door shuts even when the company has the money. And Binance did have the money. It says it set aside more than $6.3 billion dollars of its own funds.

By Saturday, it said it had replaced 90% of what was stolen. And by Sunday, 95. It published a fresh proof of reserve so people could check their balances were backed. And on Sunday morning, it started reopening withdrawals in phases. Bitcoin first, then ETH, B&B, and the big stable coins. to credit where credit's due.

That's a company doing right by its users, but it's a pattern we've seen before. Something goes wrong at the exchange and the first thing that happens is the door shuts in 2019 after that first hack. Here's Changpang Xiao CZ, Binance's founder and boss at the time on a live stream the next day. Um so I think the biggest thing is I do want to beg people to um um uh forgive us in terms of uh not being able to withdraw um for the next week or so. So um we do want to make sure that we're completely secure and we we solve everything before uh before we actually turn things back on.

Not being able to withdraw for the next week or so, that was a $40 million hack and the door shut for about a week. And that's not the only way an exchange can handle it. When Bybit was hit for 1.5 billion in February last year, its boss Benzoo went live within hours.

Bybit is clients asking uh will buy bit any any time suspend withdraw or cancel withdraw. We don't have the plan to suspend or cancel withdrawers at the moment. Uh we are still receiving all the withdraw requests. Um and in fact 70% of them have been uh approved and processed. We don't have the plan to suspend.

Even Bayet had to slow its ETH withdrawals until it lined up alone to cover them. So, two exchanges, two different calls, both made by people running the exchange, not by the people whose coins were inside it. That's the whole point. When your coins sit on exchange, whether you can take them out on a bad day is somebody else's decision. And most of the time, the door opens again, but not always.

On the 8th of November 2022, FTX stopped withdrawals, too. One FDX customer told CNBC how that felt.

I requested all withdrawals of all my assets, but none of them completed. None of the withdrawals ever came through.

You're just helpless. Like, what do I do? I was just in so much shock that that could happen.

You're just helpless. Binance isn't FTX. Binance had the money and it's paying. But from the outside, for those first couple of days, the screen looked exactly the same. a gray button and a message saying, "Please wait." And you only find out which kind of story you're in after the door opens again or doesn't. You don't get to choose which story you're in after the door shuts, only before.

So, here's a question this leaves. Not was Binance hacked, not will they pay, it's this. If the place your coin sit shuts its doors tomorrow, how much of your money would be stuck behind them? When DW News asked a cyber security specialist what an ordinary customer should actually do, this is what he said. Um, but yes, some people will be thinking about what to do with money that they have in crypto exchanges.

Now, I would always advise to spread it uh between cold storage. That means on a physical USB you might actually be able to hold in your hand and then choose um reputable and a few crypto exchanges just to minimize that risk on a single attack. a physical USB you might actually be able to hold in your hand. That's a hardware wallet where you hold the keys yourself. Nobody else can switch your withdrawals off because there's nobody in the middle. The flip side is that it's on you to set it up properly and keep safe.

It's not the right fit for everyone and it's a bit most people put off. Here's a simple one, and it takes 5 minutes. Open whatever exchange app you use. Add up roughly what you've got sitting on it. Then ask yourself one honest question.

If that app showed a gray withdrawal button for a week, would I be fine or would I be stuck? If the answer is stuck, that's not a reason to panic. It's a reason to have a plan before the next Thursday night. That's the check. 5 minutes and you'll know where you stand.

So, where's the money? Roughly 3 billion is frozen, mostly those stable coins. Binance has replaced about 95% of what users lost with its own money and says the last 5% is smaller tokens that take longer to buy. The FBI expects more of it to be moved through DeFi apps and swap services and it's asked other exchanges to block anything linked to it and Binance has promised a full report on how this happened. My honest take, Binance handled the aftermath about as well as anyone could.

It paid up. It published its reserves and it started reopening under 3 days. A wallet that should have held pocket money held billions. And for 2 and 1/2 days, the people behind more than 300 million accounts found out their coins weren't in their hands. They were in Binance's.

So, two things to watch from here. Binance's full report on how this happened and those Bitcoin chunks the day they started moving. We'll learn a lot more and I'll be watching. If you're going to run that five minute check, pop checked in the comments. Most people leave coins on exchange because it's easy.

It's where they bought them. The app's on their phone and it's always worked, not because they're dark. Nobody ever sat them down and showed them how to hold it properly, did they? I'm not going to tell you what to do with your bag in a video because that depends on what you're holding and how it's set up. But you don't have to work it out on your own.

Thing is, it's not hard to sort. And that's what our private intelligence network is for, guys. Most of what I bring you on this channel comes from inside it. And in there, it goes a lot deeper than I can in one video. Basically, the research team digs into where is heading and members hear it first.

They'll help you get it on your own keys so no bank or exchange can freeze it or switch your withdrawals off on a bad night. They'll show you how to get what you're already holding earning instead of just sat there. And every week there's a call where the team walks you through how they're reading it and when they're buying and taking profit themselves so you're not guessing and everyone in there is holding a decent bag and in it for the long haul. So same as you and me. Honestly, I'd be a lot further along myself if we'd started all coin pro sooner.

And if you ran that check earlier and the honest answer was stuck like a lot of people on Binance last Thursday, that's exactly what the free 15-minute call is for. And it's the same with anything you hold really. like if you don't actually know where it sits. For one of our members, Tom, it was getting everything organized so he knows what he holds and where it is. This is a real review he left on Trust Pilot. He says his coach went through it with him step by step.

Wallet, setting up a hardware wallet, and organizing everything, so he actually knows what he holds and where it sits. And he says he's far more confident thinking about cold storage now than when he started. Results like Tom's are exceptional and they didn't happen by sitting still. So, be exceptional. Look, you could leave it and hope the timing works out or try and piece it together yourself at midnight watching a gray withdrawal button on your phone like a lot of people did on Thursday.

I'd rather you just spent 15 minutes with the team and came away with a plan for your bag. It's free and worst case, you come away clearer. So, here's what I do. Tap more under this video and hit the very first link. Watch the short free briefing. then book your free 15-minute call with someone on the team right underneath him.

They'll go through where you're at with your crypto and tell you straight whether it's a fit for you. That's a first link. Pause this, do it now and come straight back. I'll be right here. It's built for people holding $50,000 or more in crypto.

And if that's not you yet, that's absolutely fine. Keep watching these videos with me. They're up every day. They're free. And we'll keep learning this together.

And look, none of this is financial advice, guys. It's my take after a lot of digging. Crypto carries risk. What's happened before is no guarantee of what happens next. And a member's result isn't a promise of yours.

Your keys stay with you the whole way through. The team never needs them, and that is the whole point. So stick with me, subscribe, and there's a new one every day. Thanks for watching, guys. Keep your head stack with purpose, and I'll keep you posted.

[music]

Hey, [music] hey, hey.