Binance says about $6.3B left hot wallets on Oct 29, the largest crypto theft reported, about 4x the $1.5B Bybit hack, with most funds moving in about 20 minutes across 10 chains (Binance estimate).

Binance says about $6.3B left hot wallets on Oct 29, the largest crypto theft reported, about 4x the $1.5B Bybit hack, with most funds moving in about 20 minutes across 10 chains (Binance estimate).

Entry was a compromised DevOps engineer laptop reaching a service container that submitted withdrawals, with no private key leak found, later updated to additional breach points (cause, update).

On Ethereum the attacker sprayed 50 EIP-7702 authorizations for Binance 14 in one type-4 tx (nonces 18,914,775 to 18,914,824), one hit and handed the wallet to an attacker contract (Blockaid). Three minutes later about $2.5B left in one tx, plus repeat sweeps, while the same signer sent plain transfers on BTC, Tron and L2s.

The attacker put 60M USDT into Aave and borrowed 19,762 wETH (~$45M) before Tether froze the USDT, keeping unf freezable ETH.

Frozen so far is about $3B, including 1.567B USDT by Tether and 800M+ USDC by Circle (frozen total). Unfrozen is about $3.3B, mostly BTC and ETH attributed by TRM Labs to North Korea TraderTraitor.

Binance says user funds are safe and losses will be covered from SAFU and company funds, deposits normal, withdrawals to resume in about 45 hours (update). Watch the updated Proof of Reserves for what remains.

SAFU size (~15,000 BTC, ~$1.15B at $77,680 on Binance spot) covers under a third, so the rest is corporate funds. Frozen is not recovered, only blacklisted in place.