On October 29, major cryptocurrency exchange Binance suffered an estimated $6.3 billion security exploit resulting in unauthorized outflows across Ethereum, Bitcoin, Tron, Arbitrum, Optimism, and Avalanche. Preliminary findings point to a compromised DevOps engineer's laptop that granted access to a service container to submit unauthorized transactions, though Binance confirmed no private-key leaks occurred.
Technical Exploitation and High-Profile Reaction
The breach involved 50 signed EIP-7702 authorizations submitted to align with the target wallet's changing nonce, with one matching authorization executing malicious code. Reactions swept social media, with former X head of product Nikita Bier posting: "The largest crypto exchange in the world just experienced the largest robbery in human history – and the person running it is a nomadic autistic man in Dubai posting “Funds are SAFU!” What a time to be alive." Meanwhile, Elon Musk remarked that "Everyday is Zeroday." Former CEO CZ noted the breach appeared to be a hack and expressed confidence users would be covered, while Co-CEO Yi He confirmed Binance pledged full reimbursement through its SAFU fund and corporate assets.
Multi-Chain Asset Freezes and Market Liquidations
In response to the exploit, Tether froze over $1.567 billion in USDT, Circle froze more than $800 million in USDC, and the Arbitrum Security Council intervened alongside token issuers, pushing the total frozen assets near $3 billion. Derivative markets reacted sharply as Bitcoin fell near $76,300, triggering $478.9 million in position liquidations (84.6% longs). Ethereum recorded $363.5 million in liquidations (83.5% longs), Solana saw $82.1 million wiped out, XRP experienced $38.1 million in liquidations, and HYPE saw $31.3 million with short positions taking the brunt. DeFi protocols took defensive steps: Aave froze 175 markets across 16 networks on V3 and 117 markets on V4, while Kamino paused SOL and BTC borrowing.
Key Takeaways
- $6.3 Billion Stolen: Attackers targeted six major blockchains via a compromised DevOps laptop on October 29.
- $3 Billion Frozen: Tether ($1.567B) and Circle ($800M) coordinated with issuers to halt stolen tokens.
- Attacker Traced: ZachXBT linked stolen funds moving through THORChain to the same address used in the Bitget heist, previously tied to North Korea's TraderTraitor.
On-Chain Sleuthing Links Hackers
Blockchain investigator ZachXBT established a link between the Binance incident and the Bitget exploit, revealing that stolen funds from both attacks routed through THORChain to the same wallet address. The Bitget breach was previously attributed to the North Korean threat group TraderTraitor, which was also linked to the Kelp DAO exploit. Additionally, MistTrack observed stolen TRX moving via Bitget Wallet Swap Bridge to an address beginning with 0xCd68, previously used by the Phemex attacker. Bitget Wallet confirmed it partnered with Binance to disrupt fund movements by blacklisting addresses and providing real-time on-chain data.
Why It Matters
This record-setting $6.3 billion breach underlines that critical infrastructure credentials remain vulnerable even at the largest industry entities. The rapid containment of nearly $3 billion demonstrates unprecedented cross-chain emergency response capability between issuers, exchanges, and security councils. However, the deployment of sophisticated vectors like EIP-7702 and ties to state-sponsored actors like TraderTraitor signal an escalating threat level that will force protocols to overhaul access controls and DevOps permission structures.
