Binance Theft This is the largest exchange hot wallet theft in crypto history (officially estimated at approximately $6.3 billion, with on-chain statistics at approximately $5.5-6.4 billion), far exceeding Bybit's $1.5 billion record in 2025. The incident is still developing; the following is a series of posts that can be directly published. 1. Binance Hot Wallet Suffers Largest Theft in History! On October 29-30, approximately $6.3 billion in assets were stolen from multi-chain hot wallets. The official response confirms that user funds are safe, and the losses will be fully covered by the SAFU Foundation and company funds. Withdrawals are suspended and are expected to resume within approximately 45-48 hours; deposits are normal. This is the largest exchange theft in crypto history in terms of the amount of money stolen. Theblockbeats 2. | Timeline (Beijing Time) October 28-29: Hackers withdrew a small amount of ETH from Tornado Cash, deployed and practiced a cleanup contract. October 30, around 4 AM: Outflows from multi-chain hot wallets began (XRP, SOL, BTC, Tron, etc.). 04:24: Approximately 167,000 ETH + 1.615 billion USDT were withdrawn from the Ethereum hot wallet "Binance 14" in one transaction. The main funds were subsequently transferred out within 40 minutes. After 5 AM, Tether, Circle, and others began freezing funds. Binance urgently suspended withdrawals and some transactions, announcing full compensation. Theblockbeats 3. | Attack Method The core is the EIP-7702 account abstract delegation. The hacker prepared in advance, inserting 50 authorizations into a single transaction. After hitting Binance 14's nonce, the hot wallet was "turned" into their own cleanup contract. The cleanup was performed directly after 3 minutes and 24 seconds. Official preliminary investigation: A DevOps engineer's laptop was compromised, and unauthorized withdrawals were submitted after accessing the service container. Currently, no wallet private key leakage has been found, and the attack path is more complex than a "single point of attack." Grenade 4. | Amount and Freeze Main sources of outflow (on-chain estimates): Ethereum: Approximately 3.7 billion+ Bitcoin: Approximately 18,000 BTC (approximately 1.4-1.5 billion) Tron, etc.: Hundreds of millions of USDT/TRX Tether, Circle, Ripple, World Liberty, etc., have frozen approximately $2.8-3 billion (mainly stablecoins). BTC and ETH are largely unaffected by freezing; approximately 3 billion+ remains under the hacker's control. The hacker rehearsed two days in advance, demonstrating extremely high speed. Techflowpost 5. | Official Response: Binance co-CEOs Richard Teng and He Yi confirmed: User funds are completely safe. All losses will be covered by SAFU + company funds. Approximately 3 billion has been frozen and is being tracked with law enforcement and on-chain partners. Deposits are normal, withdrawals are suspended for security upgrades. CZ also posted that "it looks like we were indeed hacked," and that full coverage will be provided. BBC 6. | Suspected Behind-the-Scenes: TRM Labs, Chainalysis, and others have pointed to the North Korean hacking group TraderTraitor (related to Lazarus) with "high confidence." On-chain traces overlap with cases like Bybit and Bitget. Binance and law enforcement have not yet officially confirmed this. BBC 7. | What Should Users Do: Your funds are safe; the platform will fully cover the losses. Deposits are available, withdrawals are suspended; monitor official announcements. Beware of fake customer service and fake compensation links. Diversify your long-term assets; don't keep all your funds on exchanges. 8. | Market and Follow-up: After the news broke, BTC briefly fell below recent lows, with significant liquidations across the network. The hackers still hold a large amount of BTC/ETH; subsequent money laundering and recovery are crucial. A full technical review report will be released after the investigation concludes.