The Great Crypto Heist

The largest hack in crypto history took place last Thursday.

More than $6 billion in assets left Binance in about 30 minutes.

That’s four times the prior record: the roughly $1.5 billion stolen from the Bybit exchange in February 2025.

It’s horrendous to see.

Thankfully, Binance will cover all losses from company resources. As of November 1, it had already replenished about 95% of the stolen assets.

Withdrawals have resumed.

And the exchange appears to be operating normally.

But the ordeal raises an uncomfortable question…

Why do exchanges keep getting hacked? And what lessons should we take away from this?

I’ll answer that today and tell you what I think it means for the industry.

But first, what exactly happened?

The Event

The first transactions began before the breach.

On October 28, the hacker began funding various wallets with ETH, Ethereum’s native asset. The ETH gave the wallets enough gas to make the transactions the exploit needed. It was like fueling up the getaway car before robbing the bank.

The hacker then deployed a contract to move funds and obtained EIP-7702 delegation authorizations signed by a Binance hot wallet (Binance 14).

A hot wallet is the exchange wallet that withdrawals come from. If you withdraw tokens from an exchange to your own wallet, they’re sent from the exchange’s hot wallet.

An EIP-7702 delegation lets a wallet, Binance 14 in this case, approves another wallet to act or send transactions. This was a major exploit as a non-Binance wallet suddenly gained authorization to send transactions to its own pre-approved contract. That was the exploit: a contract outside Binance’s control suddenly had authority to move Binance 14’s funds.

This might sound like a major security flaw in Ethereum, the public, permissionless blockchain.

But it’s not…

Binance says the attack started with a DevOps engineer’s compromised laptop. We don’t know how the attacker gained access to it. Some claim a romantic partner loyal to North Korea got physical access to the laptop, but that appears to be just a rumor. For now, that question remains unanswered.

What we do know is that the attacker submitted unauthorized withdrawal transactions to what Binance calls a service container – part of its internal infrastructure.

Think of a service container as an isolated internal system that runs one specific piece of code. In this case, it handled withdrawal requests.

That’s also how the hacker submitted transactions on other chains.

The entire hack took about 30 minutes.

The first theft was nearly $300 million worth of XRP at 20:05 UTC (4:05 p.m. ET). About five minutes later came $96 million of SOL and tokens on layer-two chains such as Optimism.

Then came the big moves…

$1.47 billion worth of Bitcoin and $1.6 billion USDT, about $400 million ETH, millions of RLUSD, and dozens of other tokens drained from the Binance 14 wallet in a single transaction.

Around the same time, $612 million of USDT and some TRX left a Binance wallet on the Tron blockchain.

By the end, the hacker had moved about $6.3 billion across 10 or 11 blockchains.

This was a sophisticated attack, and it moved at an incredible pace. In the hours that followed, the hacker tried to hide the assets in an unusual way.

The hacker spread the money across many wallets. The transactions were so numerous that some analysts believe the goal was to make the trail too costly, in computing power, for investigators to follow.

That’s how the hack took place. And it was a bad one.

Arguably more important was the response…

Emergency Powers

Stablecoin issuers acted fast.

Remember, token issuers create a contract when they launch these assets. That contract spells out key details, such as how supply is created, how much exists on day one, who or what can mint or burn supply, and even whether the token can be frozen. That last part matters.

When an asset is “frozen,” it can no longer be moved.

It’s like what the U.S. and other countries do through the SWIFT payment system when they sanction a country, individuals, or businesses – assets are frozen.

Not all tokens have this feature. In fact, most don’t. But the major U.S. dollar stablecoins do.

World Liberty Financial was the first to freeze assets tied to the hacker, at 20:57 UTC.

Tether began freezing USDT a few minutes later, starting with hundreds of millions and eventually reaching more than $1.5 billion across multiple chains.

A few minutes after that, Circle froze 823 million USDC.

Shortly after, the layer-two chain Arbitrum invoked emergency powers.

Permissionless Investor subscribers may recall that layer-two chains are somewhat centralized. That’s because the foundation or developers behind the chain typically run what’s called a “sequencer” – the mechanism that decides what transactions to include in a block. This gave Arbitrum the ability to move $30.5 million of ETH and its native token into a protected wallet.

By the end, about $3 billion of assets had been frozen. That left a little more than $3 billion in the wind.

The community is now tracking the funds onchain and trying to intercept them wherever possible.

The funds will probably go to an individual or bank that can convert them into traditional currency. From there, the money will likely find its way back to the hacker and/or the group behind the attack.

The hackers are believed to be part of TraderTraitor, a North Korean group that tends to use social engineering tactics, such as fake job offers, LinkedIn outreach, and malicious coding tests, to gain access to internal systems.

This is all bad. In all likelihood, the assets will help fund future nefarious acts.

Now for the important question: Why did this happen in the first place?

Recommended Links

Elon Musk on His New Invention: “An Infinite Money Glitch.”

Elon Musk's new patent protects a new invention that could rewrite the future of wealth forever. It's a radical new form of AI Jeff Brown calls "M.A.G.I…" One so revolutionary that Elon called it an "infinite money glitch." Click here to see the details because he believes this is a once-in-a-generation opportunity to potentially create wealth on a scale most people can't even comprehend.

What Happens to This Forgotten American Stock November 30?

A once forgotten American company is about to step into the heart of the race to build the next generation of AI. Larry Benedict believes November 30 could change how Wall Street sees it forever. See the ticker before it makes headlines.

The Honeypot

Billions of dollars in crypto sit on centralized exchanges.

Look at the top holders of almost any token, and you’ll often see exchanges among the biggest wallets. Here are the top holders of Tether’s USDT on Ethereum. Eight of the top 12 wallets belong to exchanges.

Source: Etherscan.io

If you’re a hacker looking for the biggest payoff, these are your targets. An individual’s hardware wallet isn’t worth the effort.

This is the issue with centralization. It creates honeypots – big vaults that make juicy targets.

Many are applauding the token issuers for freezing funds. And, to be clear, I’m glad they did. But it’s like handing power to a dictator to fight off the barbarians. You can do it, but you don’t want to have to. And it’s not the long-term answer.

Decentralized finance (DeFi) is.

With DeFi, you are the custodian. You hold the keys. And you, not a third party, can move the funds.

That’s why this Binance hack and even the Bybit hack that happened last year run counter to the ethos of public and permissionless solutions.

It’s a fact. And the industry had better get its collective head around that. Because the targets could soon get a lot bigger.

Bigger Targets

Wall Street is attempting to move stocks onchain using permissioned rails.

You think the Binance hack was big?

Wait until tens, and then hundreds, of billions of dollars’ worth of tokenized assets are sitting in one centralized vault.

Believe me, you don’t want to see what happens if bad actors worm their way in.

This is no longer a philosophical debate. We no longer have that luxury.

The hack should teach us that blockchain’s open nature helped end it quickly. It should also show us that the attack happened only because of centralization.

The knee-jerk response from many will be more – more controls, more centralization.

But how many times must we learn this lesson?

Centralized things are fragile. And fragile things break.

If the upgraded financial system we’re building is to be secure, it will have to embrace the ethos of decentralization.

Your Pulse on Crypto,

Ben Lilly
Editor Chain of Thought