Reviewing the entire process of the Binance 5.8 billion theft case, He Yi stated that he would bear all the stolen losses

Author: Gu Yu, ChainCatcher

At 4:24 AM Beijing time on October 30, on-chain data showed that Binance's hot wallet marked as Binance 14 transferred 167,464 ETH to an address that had never appeared before, along with 63 tokens including approximately 1.615 billion USDT. This transaction was valued at approximately 2.5 billion USD.

Forty minutes later, multiple statistics indicated that the total outflow was around 5.8 billion USD. This figure surpassed Bybit's approximately 1.5 billion USD in February 2025, becoming the largest exchange theft in cryptocurrency history—belonging to an exchange with the largest security team and the thickest balance sheet globally.

Just a few hours earlier, the leading prediction market trading platform Polymarket suspended trading due to a breach by a third-party service provider. Almost simultaneously, two major cryptocurrency trading platforms suspended trading or withdrawals due to hacking incidents, highlighting the extreme severity of security in the crypto space.

I. 40 Minutes, 5.8 Billion USD

The preparations for the attack were completed the day before the transfer occurred. From October 28 to 29, a brand new address received three transactions of approximately 0.1 ETH through the mixer Tornado Cash—this was for gas fees. Exchanges would never use mixers to pay for gas, prompting on-chain analyst Spreek to issue the first warning, stating: "This could be routine wallet maintenance, but it looks extremely suspicious."

At 4:24 AM, the first abnormal transfer occurred. Twenty-four seconds later, the second wallet Binance 16 transferred 28,005 ETH to the same address. At 04:41, Hot Wallet 34 transferred 780 million USDC; at 04:59, another 43 million was transferred. The entire process was quiet, continuous, and uninterrupted, resembling an authorized internal allocation. Within 15 minutes, the attacker transferred approximately 195,460 ETH to another new address.

As of the time of publication, the outflow associated with Binance's tagged wallets was approximately 5.8 billion USD: 3.528 billion on the Ethereum network, 1.449 billion in Bitcoin, 628 million in Tron, and a total of 38 million in Arbitrum, Optimism, and Base. It should be noted that outflow does not equal theft, nor does it equal final loss—Binance has not disclosed any figures, and there is a possibility of misjudgment in on-chain tagging.

However, the market's reaction preceded the facts. Bitcoin briefly fell below 79,000 USD, Ethereum dropped below 2,240 USD, and within an hour, the entire network saw liquidations of 627.7 million USD, of which 606.6 million were long positions, with Binance accounting for 344.8 million. BNB fell by as much as 6%, to around 710 USD.

II. 2.54 Billion USD Frozen

Within an hour of the incident, Tether and Circle took action. Tether CEO Paolo Ardoino stated that over 1.567 billion USDT had been frozen, with the initially disclosed figure being 971 million; Circle froze approximately 823 million USDC.

Binance's verification results provided on the morning of the 30th indicated: The total amount of frozen assets is currently 2.54 billion USD, and this figure may continue to increase as cooperation with law enforcement, issuers, blockchain intelligence companies, and industry partners progresses.

This is the most noteworthy structural fact of this incident. USDT and USDC are centralized issued tokens, and the issuers retain the power to freeze any address—most likely, the stablecoins stolen by the hacker are now locked in place and cannot be moved. In contrast, ETH and BTC belong to networks without issuers, and no institution can press that button.

Thus, an ironic contrast emerged: In this industry, the more "decentralized" the funds are, the harder they are to recover after being stolen; the more reliant on centralized issuers, the safer they are.

Responses from various parties formed a clear spectrum of statements. Binance's official response was the most restrained: first noting "awareness of reports of potential security issues, under investigation, and user funds have not been confirmed to be affected"; then stating that some users' withdrawals were hindered due to "technical errors" and were being restored; by the morning of the 30th, it changed to "conducting security checks, withdrawals will resume once security issues are fully resolved," while also suspending withdrawals and Binance Alpha trading.

Co-founder He Yi confirmed that the team was investigating and stated that they would cover all stolen losses. CZ, who is no longer involved in daily management, was the most direct: "User fund security, it appears Binance has indeed been hacked. I no longer manage Binance.com, but as a shareholder, I expect all user funds to be fully covered."

Regarding net losses, DefiLlama founder 0xngmi calculated: Binance's custodial assets are approximately 144 billion USD, and after deducting the frozen stablecoins, the loss is about 1 billion USD, accounting for 0.69% of custodial assets, "Binance can easily cover it with its balance sheet." CZ retweeted and added: The loss may be slightly higher than this figure, but it will be fully covered.

This raises another question. Binance's user security asset fund SAFU, established in 2018, has long been publicly stated to be around 1 billion USD. If the net loss is indeed slightly higher than 1 billion as CZ mentioned, then the source of the backing is no longer that fund, but rather Binance's own balance sheet. The backing mechanism has shifted from "a prepared pool" to "the credit of a company."

III. Binance's Third Time: From 41 Million to 5.6 Billion

This is not the first time Binance has been hacked.

On May 7, 2019, at block height 575012, hackers withdrew 7,000 Bitcoins from Binance's hot wallet, valued at approximately 41 million USD at the time, accounting for 2% of its total Bitcoin holdings. Binance's announcement described it in detail: hackers used phishing, viruses, and other composite attack techniques to obtain a large number of users' API keys and Google Authenticator 2FA codes. At that time, CZ said, "Today is not a good day, but we will remain transparent," and the SAFU fund fully covered the losses, with deposit and withdrawal services suspended for a week.

On October 7, 2022, a vulnerability appeared in the cross-chain bridge Token Hub of BNB Chain, allowing attackers to mint 2 million BNB in two transactions, valued at approximately 566 million USD, leading BNB Chain to temporarily suspend block production. Prior to that, there were two risk control incidents in March and July 2018 triggered by phishing attacks on API users.

In seven years, there have been three incidents, with amounts rising from 41 million to 566 million and then to 5.6 billion. The numbers have increased over a thousand times, but the focus of the attacks has hardly changed: each time it was not the mathematics of the keys that was breached, but the processes surrounding the keys that were circumvented.

In 2019, it was phishing to obtain API keys and 2FA; in 2022, it was the verification logic of the cross-chain bridge; this time, on-chain traces pointed to the signature permissions of the hot wallet being stolen. The forms have changed, but the location has not—it's always at the seam between "people" and "systems."

IV. 2026, The Dark Year for Exchanges

A few hours before Binance's incident, another leading crypto platform had just experienced a much smaller-scale attack with a nearly identical path.

In the early hours of October 30, the prediction market Polymarket released a statement on its official account: it had discovered and fixed an issue affecting the international platform Polymarket.com, where a third-party provider was breached, and the incident had been referred to law enforcement; out of an abundance of caution, the platform temporarily suspended trading. About an hour later, trading was fully restored. Polymarket stated that anyone affected would receive full compensation.

What was breached was neither the wallet nor the contract. According to CNBC and NBC News reports, the issue originated from DebugBear—a UK-based website performance monitoring and web analytics tool that was hacked, leading Polymarket to refer the incident to UK law enforcement. DebugBear also confirmed on its X account that it was experiencing a "continuing security incident." The US platform of Polymarket was not affected.

The scale of the loss was not on the same level as Binance. Data from blockchain analysis firm Arkham pointed to approximately 2.65 million USD; CNBC cited analyses from Betting Intelligence and Polysights stating that one account withdrew at least 2.7 million USD from 710 other wallets. The amount is not large, but the nature is clear: the attackers did not touch Polymarket's system; they touched the software of others embedded in Polymarket's system.

On September 24, 2026, Bitget was also hacked, resulting in losses of approximately 387.5 million USD. According to Galaxy Research and BlockSec's reconstruction, the attackers did not obtain private keys but exploited zero-day vulnerabilities in two third-party security products to gain internal high-level credentials, inserting forged withdrawal instructions into the wallet backend and deleting traces afterward. Bitget CEO Gracy Chen stated: they did not forge user withdrawal requests, nor did they obtain the private keys of cold or hot wallets. The forged requests were structurally identical to legitimate internal transfers, so the authorization system approved them.

The Bybit incident in February 2025 was a previous version of the same script: approximately 1.5 billion USD in Ethereum, where the attackers infiltrated the UI and transaction display interface used by multi-signature signers, making them believe they were approving a routine transfer. The private keys were secure throughout, and the Safe contract was also intact—the issue was with the screen in front of the keys. The FBI attributed it to North Korea.

Galaxy Research summarized these two incidents with a statement that could almost serve as an epitaph for the entire industry: No one attacks the mathematics of private keys; they attack the person or system that tells the mathematics what to do.

The money laundering process is also industrialized. BlockSec tracked approximately 269 million USD net inflow into THORChain from the Bitget case; Galaxy stated that THORChain refused Bitget's request to deny service on the grounds of being "decentralized and permissionless"—the funds from Bybit also followed a similar path that year. When funds flow out to centralized protocols, recovering them is no longer a technical issue but a matter of stance.

Industry data is equally grim. Slow Mist reported 182 security incidents in the first half of 2026, with losses of approximately 956 million USD, a year-on-year increase of 50.41%; CertiK's figures are 344 incidents and 1.316 billion USD; Hacken reported third-quarter losses of 1.18 billion USD, a quarter-on-quarter increase of 55%, with 77% related to supply chain blind spots.

Sorted by loss amount, Blockaid's statistics show that private keys and operational security account for 74.3%; sorted by the number of incidents, code vulnerabilities account for 79.3%. In other words: the most common issue is code, and the most fatal has always been permissions.

Conclusion

From approximately $450 million of Mt. Gox, to $1.5 billion of Bybit, and now to $5.6 billion, a number that is still changing------the record for the "largest theft in history" is refreshed every few years, with even two updates in the past year, and each time the industry is wealthier, more professional, and more compliant than the last. This indicates that the speed of investment in security by crypto companies still cannot keep up with the pace of hacker technology and AI development.

What is even more noteworthy is the nature of the adversaries. The cases of Bybit and Bitget have been attributed by the FBI, Elliptic, and Chainalysis to North Korea's Lazarus, and this Binance case is highly similar in method to the previous two. A sanctioned and isolated country is treating cryptocurrency exchanges as its most stable source of foreign exchange------and the cost of this business is borne by global users collectively.

Binance can probably afford this $1 billion loss, and users are unlikely to lose a penny; withdrawals will also resume. But from Mt. Gox to Binance, twelve years have passed, and exchanges remain the most vulnerable and enticing link in this industry chain; what has been breached is never cryptography, but processes, supply chains, and the screen that displays transaction content.