North Korea Suspected In Crypto Heist
In a Nutshell
North Korea is suspected in a $1-2.5B crypto heist that exploited a compromised DevOps laptop at Binance to obtain 50 withdrawal permits, allowing the attacker to drain Binance 14 hot wallet through a single successful signature match. Tether and Circle froze ~$2.4B within an hour, but the attacker left minimal ETH to continue collecting customer deposits. The breach reinforces that exchange-held crypto is merely an IOU and that users should use hardware multi-sig wallets for large holdings, maintain minimal trading balances across exchanges, and enable all security features.
These notes were generated by AI and may contain inaccuracies.
Bitcoin is plummeting as the largest theft in crypto history unfolds. This is not just a Binance issue but a hardware wallet supply chain problem across the industry. Ethereum, Bitcoin, Tron, and dozens of other tokens were stolen from Binance. Billions of dollars disappeared before anyone knew it, with Binance now reporting the total loss at around $6.3 billion.
A security breach has hit the world's largest crypto exchange Binance, leading to an emergency freeze of assets and a major drop in the price of digital tokens. This is very bad for the crypto industry overall. Binance has stopped all withdrawals until the investigation is complete.
Customers are questioning whether their entire life savings are safe on exchanges. Tether and Circle have frozen about $3 billion of the stolen funds. This raises questions about whether this was an insider manipulation. Rumors suggest North Korea could be behind this, or possibly an AI agent, with warnings this could happen on many other exchanges.
Exchanges keep most of their crypto in cold storage wallets - offline bank vault equivalents that are very difficult to break. They also maintain hot wallets connected to the internet for immediate withdrawal requests, functioning like cash registers.
The wallet attacked was named Binance 14, known for completing around 31 million transactions and being one of the busiest wallets on Binance.
The day before the incident, money was deposited into a new wallet using Tornado Cash, a mixer that makes it impossible to trace the source. No legitimate exchange deposits money into their wallets using this method, marking the first red flag.
The same wallet created a tool allowing everything in a wallet to be emptied at once. After creating it, the attacker ran a test program successfully using this technique.
Every time the Binance 14 wallet sends money, it takes a ticket number that constantly changes. Ethereum's programmable money feature allows wallet control to be given to a program through permits that require two conditions: Binance's signature and the exact current ticket number.
The attacker obtained Binance's signature on 50 different permits with different numbers. Of these, 49 were rejected but one matched, allowing the robot to take control of the cash register.
The attack stole approximately 167,000 Ethereum worth about $1.6 billion, plus $1 billion in Tether and 61 other tokens, totaling about $2.5 billion in a single transaction costing just 93 cents. An on-chain analyst noticed the issue and posted about it, but the attacker was already removing coins.
During this time, about 195,000 Ethereum moved to a new wallet, and another Binance wallet sent another $780 million worth of USDC to the attacker. Within an hour, Tether locked the stolen USDT, Circle locked the USDC, and about $2.4 billion was frozen.
The attacker left just one ETH in the wallet to keep it running so additional deposits could be stolen. Binance's automated systems continued normal operations, collecting customer deposits and replenishing the hot wallet.
According to Binance's preliminary investigation, a DevOps engineer's laptop was hacked. From this laptop, the attacker accessed an internal Binance service to submit unauthorized withdrawal transactions. The attacker never stole the vault keys but broke into the system that uses the keys.
The 50 permits strategy indicates the attacker did not have Binance's master key, as having the key would not require multiple guesses. All 50 slips are visible on the public blockchain, with 49 marked as invalid and only one marked as successful.
Approximately 18,000 Bitcoins and hundreds of millions of dollars of Tron network tokens also left Binance wallets, as the permission strategy does not work for Bitcoin or Tron. Once inside the withdrawal authorization system, the attackers were not limited to just one blockchain.
North Korea rumors emerge because hacking employee computers through malware, phishing links, or fake job interviews matches North Korea's past tactics. This is similar to the Bybit attack last year where hackers stole $1.5 billion by compromising a wallet software developer's machine. The FBI blamed North Korea for that attack.
Just 2 days before this attack, Binance stated its security team had thwarted several North Korea-related cyber attacks.
The founders of DeFi Llama estimate the actual loss is likely closer to $1 billion, which CZ reposted. Binance holds approximately $144 billion in customer assets, making even a $1 billion loss less than 1% of total assets.
Binance maintains an emergency fund called SAFU (Secure Asset Fund for Users) with about 15,000 bitcoins worth approximately $1.2 billion. A portion of this fund has been set aside as capital required by Abu Dhabi regulators, so not all may be free to use. The fund Binance promised to replenish applies only if Bitcoin's price drops, not to compensate for hacking.
When holding crypto on an exchange, users only have an IOU - a promise from the exchange to return funds. Binance is large enough to overcome this loss, but smaller exchanges might not be able to. The speaker lost over 10 bitcoins on a small exchange that went bankrupt.
Tether and Circle's ability to freeze $2.4 billion in less than an hour demonstrates that stablecoin companies can instantly freeze billions of dollars whenever they want. While this power was used against a thief in this case, the same capability applies to everyone.
For significant amounts of crypto, only trust multi-sig solution wallets. For active trading, move money to wallets where you control the keys, such as hardware wallets. Buy hardware wallets directly from manufacturers - never buy used wallets or from unreliable sellers like Amazon or eBay.
If keeping money on exchanges for trading, only keep what you are actively using and spread it across different exchanges. Turn on every security feature including two-factor authentication using authenticator apps or physical security keys, not text messages. Set withdrawal whitelist addresses so crypto can only be sent to approved addresses.
The speaker does not trust DeFi or decentralized exchanges because they are safe until something goes wrong.
Scammers love these incidents and spread fake support messages and compensation forms. No legitimate person will message you to help recover money. Never copy wallet addresses from transaction history as scammers send fake tokens from similar-looking addresses.
Stablecoins like USDT and USDC are actually IOUs that can be frozen. Self-custody is not risk-free - if you lose your recovery phrase, no one can help recover it. Back up recovery phrases on titanium or steel plates and add a 25th word passphrase for extra security.
Keep Andrei Jikh in your library
Save the videos and channels worth coming back to, and find them again in one place.
