Discuss the incident of Binance being hacked for 5.6 billion USD

Author: Seven Research

I woke up relatively early today, around four or five o'clock. When I opened Twitter, it was all news about Binance being hacked.

This morning, I browsed through several security agencies' tweets, and the amount stolen this time is indeed very shocking. The earliest reports indicated that the total scale of several hot wallets with abnormal outflows was about 5 billion USD (with the highest estimates reaching 5.5 billion to 5.8 billion); focusing solely on the Ethereum chain, the core hot wallets that were drained had losses between 3.3 billion to 3.5 billion USD. This directly broke the record of 1.5 billion USD stolen from Bybit at the beginning of last year, marking it as the largest hacker attack in the history of the cryptocurrency industry.

Subsequently, through joint efforts, nearly 3 billion USD was frozen. The response from stablecoin issuers was quite swift; about 40 minutes after the incident, Tether froze 1.57 billion USD worth of USDT, Circle froze 823 million USD worth of USDC, and Ripple also intercepted 200 million USD. However, even so, the hacker still managed to transfer over 250,000 ETH (worth about 570 million USD) and a large number of tokens that could not be frozen within just a few minutes.

As for the reason for the theft, it currently appears that a highly privileged main private key was likely leaked.

The process uncovered by the security team Blockaid is quite dramatic. At 4:21 AM Beijing time today, the hacker first withdrew some ETH from Tornado Cash as gas, then directly initiated an EIP-7702 authorization transaction targeting Binance's core hot wallet "Binance 14." Since the hot wallet was still processing users' daily withdrawals normally at that time, the hacker did not know the real-time nonce (transaction sequence number) and simply used the private key they had to blindly sign 50 consecutive transactions, which surprisingly hit the mark, directly linking the execution authority of the entire hot wallet to a malicious contract they had prepared in advance.

Just three minutes after gaining access (at 4:24 AM), the hacker executed a transaction that withdrew 167,000 ETH, over 1.6 billion USDT, and more than 60 types of tokens from Binance 14. Even more critically, Binance 14 was also the owner of another smart wallet (Hot Wallet 34) on the chain, and by 4:41 AM, the hacker casually drained the 780 million USDC from that wallet as well. This method is not a contract vulnerability; it indicates that the main private key is completely in the hacker's hands.

After the incident, CZ also tweeted acknowledging that it looked like they were hacked. Binance has now suspended withdrawals, and Binance Alpha has also stopped. I tried to make a withdrawal this morning, but it was stuck there and couldn't move, which indeed has a significant impact.

I noticed that many KOLs on Twitter seem quite optimistic, believing that Binance is large enough to afford the loss, but I feel this is a very serious incident. The market has already reacted honestly, with BTC instantly dropping below 79,000 USD, BNB falling nearly 7%, and within an hour after the incident, the entire network exploded with 628 million USD (over 600 million from long positions). For more detailed technical aspects, I will summarize an article using AI later and share it with everyone.

You can check out a previous article I wrote titled "Top Exchanges in the Crypto Space Hacked for 350 Million USD: Why Has the Crypto Space Become a 'Cash Machine' for North Korean Hackers? Who is North Korea's Lazarus?"

Moreover, I believe what everyone needs to be most vigilant about now is not whether Binance can afford the loss, but the series of institutional reactions triggered by this incident.

Currently, Binance still has 144 billion USD in assets, with a lot of institutional money and business tied up there. In fact, the chain reaction began early this morning: after the hacker obtained the coins, they immediately authorized Aave on-chain, clearly intending to deposit the stolen hundreds of thousands of ETH to borrow clean stablecoins, shifting the mess onto the DeFi protocol. This directly frightened Aave into urgently freezing the V3 market on the Ethereum mainnet, and the lending leader on Solana, Kamino, also paused its lending pools. Additionally, the stolen assets included Binance's own interest-bearing asset wBETH; if the hacker forcibly crashes it on-chain, those big players and institutions leveraging wBETH for circular loans would face a series of liquidations.

Furthermore, most market makers and quantitative institutions in the circle currently have their main funds and margin accounts at Binance. Many institutions engage in cross-exchange arbitrage or hedging, and now that Binance has suddenly closed withdrawals, their funding chains are instantly stuck—if the market continues to fluctuate violently, they won't be able to withdraw money from Binance to supplement margins elsewhere, and to prevent their own liquidation, they can only be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. This is also why, despite the stolen assets being from the Ethereum ecosystem, Solana and a bunch of altcoins crashed today.

Not to mention that many second- and third-tier small exchanges, wealth management platforms, and even the treasuries of many project teams lack depth; essentially, they just pool money into Binance's institutional accounts to earn interest or hedge. If Binance prolongs the withdrawal suspension, these institutions and small platforms with their funds locked in Binance will immediately face a bank run.

I wanted to discuss this because I previously worked at a project team and experienced a few small-scale hacker attacks.

At that time, the attacks mainly targeted community members with phishing links. The most memorable incident also occurred around four or five in the morning, when the Asian team was sound asleep, and the hacker specifically targeted Discord's Mod accounts for phishing, stealing accounts with significant permissions, and then posted phishing links in the community, resulting in one user clicking on the compromised link.

Waking up around four today to see Binance was hacked was also a coincidence, and I had some money in there.

I have a feeling that hackers have become stronger in utilizing AI recently. Of course, it's not that AI directly breaks cryptography, but just like ordinary people can amplify their abilities with AI, hackers with AI become even more formidable, and their attack methods will be stronger. Adding to this, last month (September 24), Bitget was hacked for 380 million USD due to a zero-day vulnerability in third-party security software in the early morning, and today Polymarket also suspended trading due to being hacked by a third-party service provider. In just one month, top platforms have been continuously breached.

One of my personal suspicions is that Binance or related teams internally might also be using AI and accidentally leaked some key information during the process. Many operators or developers often lack sufficient security awareness (this is something I reflect on myself), for example, to save time, they might directly feed AI with configurations or permission logic, inadvertently allowing hackers' automated tools to catch vulnerabilities and penetrate through them.

It feels like a combination of black swan events: just yesterday, Google's earnings report was disastrous, with quarterly capital expenditures burning 51.4 billion USD, free cash flow turning negative at 9.1 billion, and the stock price plummeting 10% in one day, evaporating 500 billion USD in market value, raising market concerns about the AI bubble to the max; then today, Binance has this level of security incident, as if all the black swans have converged together.

Everyone should be extra cautious lately, especially friends who have assets in small exchanges or centralized wealth management, and try to protect their asset security:

1. Avoid using exchanges whenever possible; this type of incident is likely to increase in the future. Especially for smaller exchanges with thin foundations, no one knows if their underlying funds are stuck in Binance and cannot be withdrawn, so don't gamble on others' ability to pay.
2. Use hardware wallets whenever possible. Keep the mnemonic phrase stored offline, and don't sign unclear authorizations on-chain (with EIP-7702 now, signing a random authorization could hand over the entire wallet's permissions).
3. Use multi-signature wallets whenever possible. Whether it's personal large funds or institutional money, a single private key is too vulnerable in the current attack-defense environment; separating permissions across different devices is much safer.