The Illusion of Security in the Cryptocurrency Industry Seen from the Theft at Binance: Freezing, Compensation, and Centralization
Author: Zhou, ChainCatcher
In the early morning of October 30, Beijing time, Binance was attacked by hackers, and assets from multiple hot wallets on various blockchains were successively transferred out. On the same day, Binance confirmed that the total impact of this security incident was approximately $6.3 billion, with about $3 billion frozen on-chain, and promised to cover all losses with the SAFU fund and the company's own funds.
Based on the value at the time of the theft, this is the largest theft in recorded history in the cryptocurrency industry, approximately four times the amount stolen in the 2025 Bybit theft case. Following the news, Bitcoin briefly fell below $77,000, and BNB dropped nearly 10%.
Aside from the $3 billion that has been frozen, where did the remaining assets go? Binance stated that this was a complex attack; how did the attackers manipulate the exchange's signature system for their use? What does the promise of full compensation mean in terms of cost?
1. 50 Pre-signed Authorizations, 3 Minutes and 24 Seconds to Empty Binance's Core Hot Wallet
The process of fund outflow on the night of the attack has been compiled by ChainCatcher in the article “Reviewing the Entire Process of Binance's $5.6 Billion Theft, He Yi States That All Stolen Losses Will Be Covered”. Subsequent on-chain reviews by various parties added more details about the attack.
According to the review by Cobo co-founder Shen Yu, the attackers had prepared a transfer list covering 64 tokens in advance and practiced twice with a test wallet, the last time being about three and a half hours before the actual attack. Slow Mist founder Yu Xian stated that the hacker's operations were somewhat rough, but they had done sufficient rehearsal preparations before taking action.
According to statistics from TRM Labs, the first wallets transferred out were five wallets on the XRP Ledger, at 4:05 AM, about 20 minutes earlier than the large transfers on Ethereum. Subsequently, wallets on Solana, Bitcoin, Tron, and other chains were successively transferred out, ultimately involving ten blockchains.
On Ethereum, both Shen Yu and security company Blockaid's analysis showed that the attackers broadcast a transaction containing 50 authorizations at 4:20 AM, targeting Binance's hot wallet Binance 14.
Using the EIP-7702 mechanism, ordinary wallets can delegate execution rights to a smart contract by signing authorizations, but each authorization is only valid for the transaction sequence number at that moment.
Since Binance 14 was continuously processing user withdrawals, the sequence number kept changing. The attackers had prepared 50 consecutive sequence number signatures in advance, one of which hit, and 3 minutes and 24 seconds later, the wallet assets were transferred out in one go.
After that, the delegation remained effective; as soon as new funds entered the wallet, they would be swept away again. The last recorded transfer by TRM Labs occurred at 7:56 AM. As assets left the Binance wallet, a race between freezing and transferring also began.
2. Approximately $3 Billion Frozen, 18,000 BTC Still in the Hands of Hackers
Stablecoin issuers were the first to act. 37 minutes after the main transfer occurred, Tether froze over 970 million USDT in the main receiving wallet. Tether CEO Paolo Ardoino subsequently stated that over 1.56 billion USDT related to this incident had been frozen.
Circle CEO Jeremy Allaire also stated that Circle had frozen over 800 million USDC. Ripple froze 40.54 million RLUSD, and World Liberty Financial also froze related USD1.
According to on-chain statistics, of the approximately $3.75 billion in assets transferred on Ethereum, about $2.4 billion has been frozen; of the approximately $630 million transferred on Tron, about $380 million has been frozen.
The attackers clearly anticipated this. Shen Yu pointed out that during the attack, the attackers exchanged some USDT and other freezeable assets for ETH to evade issuer freezes. According to TRM Labs, the attackers sold about 325 million USDT to market makers at a discount of over 10%, exchanging it for about 122,000 ETH.
On-chain analysis platform Lookonchain monitored that the attackers also sold seven tokens including UNI, ENA, and PEPE, collectively obtaining about 70,000 ETH. On-chain analyst Yu Jin lamented that the only winner in this market is the hacker.
According to Arkham statistics, issuers have frozen about $2.8 billion, while the assets that hackers can still transfer amount to about $2.9 billion, mainly consisting of 496,000 ETH across ten addresses, and 18,270.2 BTC distributed across 19 addresses that have not moved since 4:48 AM.
ETH has begun to transfer; according to on-chain monitoring platform Onchain Lens, the attackers transferred over 17,000 ETH to a new address in the afternoon of the 30th.
Regarding the identity of the attackers, TRM Labs attributed them with high confidence to the North Korean hacker group TraderTraitor, which the FBI previously identified as the mastermind behind the Bybit case.
On-chain detective ZachXBT pointed out that the attackers might be the North Korean Lazarus Group and discovered that funds from Binance and the Bitget theft case in September flowed into the same address via THORChain and were mixed.
Slow Mist founder Yu Xian also stated that the funds from the Binance hacker were linked to the hacker address from the early 2025 Phemex theft case, which was found to involve North Korean hackers.
However, TRM Labs pointed out that this time the attackers mainly used market maker exchanges and lending protocols to transfer funds, which is different from the extensive use of cross-chain bridges in the Bybit case.
3. Binance Promises Full Compensation, Investigation Still Ongoing
After the abnormal transfers were detected, Binance first stated that it had noticed reports of potential security issues and had not yet confirmed whether user funds were affected.
Around 5:52 AM, Binance stated that some user withdrawals were blocked due to technical errors.
About 20 minutes later, the official announcement stated that withdrawals would resume after the security issues were fully resolved, and Binance Alpha trading was subsequently suspended.
Around 8 AM, Binance co-founder He Yi stated that Binance would bear all stolen losses.
Around 8:30 AM, Binance announced the suspension of all deposits and withdrawals.
At 10:23 AM, Binance released preliminary investigation results, stating that the incident might involve a DevOps engineer's laptop being hacked, allowing the attacker to access a service container and submit unauthorized withdrawal transactions. No evidence of wallet private key leakage has been found so far.
As the investigation progressed, at 12:36 PM, Binance stated that deposits were operating normally, and withdrawals would resume within 48 hours after completing security modifications, indicating that the incident was caused by multiple factors, with a hacked computer possibly being the entry point.
At 4:56 PM, Binance stated that further investigations had discovered more points of intrusion, indicating that this was a complex attack.
Binance's Chinese community manager sisi explained that the employee's computer being hacked was just the starting point of the attack, and there was no situation where a specific engineer could operate to transfer funds with one click. Co-CEO Richard Teng stated that the investigation did not blame any individual.
It is worth mentioning that just three days before the incident, Binance had announced that its security team had identified and blocked multiple North Korea-related attacks in the past week and warned that North Korean hackers were inducing targets to run malicious programs through fake job interviews and code tests.
Regarding compensation, Binance stated that it would cover all losses through the SAFU fund and the company's own funds and would release an updated reserve proof after the repairs were completed. CZ stated that the losses were approximately $6 billion, of which $3 billion had been frozen, the SAFU fund was about $1 billion, and the remaining gap was about $2 billion.
He stated that Binance invested $500 million when Musk acquired Twitter, and the SPCX shares held as a result are now worth over $1 billion, which can cover most of the remaining gap, while the remaining part is still painful but manageable.
He Yi subsequently responded that the company's annual revenue is sufficient to cover the losses, so there is no need to sell SpaceX shares for the time being.
Previously, cryptocurrency blogger Crypto Brave estimated based on third-party estimates of $16 billion to $17 billion in annual revenue from Forbes and others that Binance could earn back the losses in less than a year.
4. Stolen BTC Hard to Create Selling Pressure, Withdrawal Suspension Impact Greater
After the news broke, the cryptocurrency market generally fell. Data shows that within an hour after the attack, the entire network experienced liquidations of $627.7 million, of which long positions accounted for $606.6 million, with Binance alone accounting for $344.8 million.
With 18,000 BTC in the hands of hackers, the market's most direct concern is selling pressure. Cryptocurrency analyst Benson Sun believes that it is not easy for this portion of BTC to truly become selling pressure. There is no large mixer with sufficient liquidity like Tornado Cash on Bitcoin, and the relevant addresses will be marked by major exchanges and on-chain analysis companies. Just splitting addresses and mixing coins is a project that takes years, and then they would still need to sell at a discount through over-the-counter transactions. In his view, the stolen BTC appears to be bearish, but in reality, it is equivalent to a disguised lock-up.
Crypto KOL Australian Lion also mentioned that Bitcoin mixing services like ChipMixer, Bitcoin Fog, and Samourai have been shut down or prosecuted in recent years. Most centralized exchanges have also implemented strict KYC and will cooperate in freezing funds. In 2016, Bitfinex was hacked for about 120,000 BTC, and the hacker only laundered a small portion. Six years later, U.S. law enforcement recovered about 94,000 BTC.
Bobby Lee, founder of the crypto storage company Ballet, stated that it is very likely that these Bitcoins cannot be recovered. For Binance, it is impossible to recover them, and for the hacker, it is also difficult to sell, so this portion of BTC may remain dormant on the chain for a long time.
The situation with ETH is different. Benson Sun pointed out that a large number of ERC-20 tokens were exchanged for ETH and then entered Tornado Cash, making it very difficult to trace. The actual market pressure that could form is estimated to be around several billion dollars.
The altcoins have actually dropped even more, with tokens like Solana and XRP generally experiencing declines greater than Bitcoin and Ethereum. KOL Seven Research believes this is directly related to the withdrawal suspension. Most market makers and quantitative institutions in the industry have their main margin accounts on Binance, and many institutions engage in cross-exchange arbitrage or hedging. When Binance suspends withdrawals, their funding chain gets stuck immediately. As the market continues to fluctuate, they cannot withdraw funds from Binance to replenish margins on other platforms and can only be forced to liquidate positions on other exchanges and on-chain to pull back cash.
Seven Research also mentioned that many second and third-tier exchanges, wealth management platforms, and project treasury essentially pool funds in Binance's institutional accounts. If the withdrawal suspension lasts longer, these platforms may face a bank run.
Some institutions have already begun to take action. Amanda He, Chief Investment Officer of ChainUp Investment, told Reuters that they have sold all their positions on Binance, transferring what they can first, and selling what cannot be transferred for stablecoins.
Regarding the market outlook, crypto trader Bonk Guy stated that he does not believe the market has escaped danger. He recalled the massive liquidation on October 11 last year, when many thought the bottom would come immediately, but the market experienced a long period of stagnation. Therefore, he advises caution in bottom fishing and to guard against a second drop.
Investors also lament that making money in the crypto market is becoming increasingly difficult, and it is even harder to keep money safe.
V. The private key is secured, but the signing process is compromised
Beyond price fluctuations, what has made the industry more vigilant about this incident is the security issues it exposed.
Binance claims that no private key leak has been found, and the attacker seems not to need the private key. TRM Labs pointed out that the wallets from which assets were transferred are distributed across ten chains, with different key types and signing schemes, yet all generated valid signatures for the attacker within about half an hour.
The most likely explanation is that the attacker gained the ability to have Binance's hot wallet signing system sign transactions at their will.
The 50 authorizations were pre-signed in bulk, indicating that this access may have a time limit or require a request for signatures through a certain system.
Ido Ben-Natan, CEO of security company Blockaid, also believes this resembles a breach of the signing infrastructure, with the private key itself not being leaked. Shen Yu also believes the core issue may lie in the signing process. Currently, no contract vulnerabilities have been found, and it remains to be confirmed by Binance whether it is a private key leak or a signing system exploitation.
However, Slow Mist's Chief Information Security Officer 23pds is more inclined to the hypothesis of a private key leak. Seven Research also believes that the fact that the attacker was able to empty another smart wallet under Binance indicates that the main private key may have fallen into the hands of the hacker.
Discussions in the industry quickly shifted to defense. OKX founder Xu Mingxing stated that security should not become a field of commercial competition. He suggested that large withdrawals to unverified addresses and transactions granting permissions to smart contracts should have additional verification and security delays, and these restrictions should be enforced at the cryptographic signature layer, so that even if the wallet management system is breached, it cannot be bypassed. He also called for the establishment of an industry collaboration mechanism to quickly freeze suspicious stolen assets by law when necessary.
Gate founder Han Lin shared a vault solution, where the private key is split into three shards through MPC, held by the user's device, Gate, and a third-party disaster recovery institution. Asset transfers are set with a 48-hour delay, during which users can freeze at any time.
It is worth mentioning that just hours before the incident, Microsoft released a report assessing the AI application levels of eight North Korean hacker groups, three of which have integrated AI into their daily attack processes. However, it has not yet been confirmed whether AI was used in this attack.
Yishi, founder of hardware wallet company OneKey, believes that neither Bybit nor Binance had their private keys directly stolen; the attacker breached the transaction approval process, and this type of risk also exists in cold storage.
Yishi cited the world's largest Bitcoin ETF, IBIT, as an example. According to CoinGlass estimates, IBIT currently holds about 760,000 BTC, mainly custodied by Coinbase. Although BlackRock plans to add Anchorage Digital as an additional custodian in 2025, there are still no transfer plans as of the latest quarterly report. The $320 million commercial crime insurance disclosed by Coinbase is shared by all its customers, covering less than 1% based on IBIT's current scale.
If a significant theft occurs and assets cannot be recovered or sufficient compensation obtained, the losses may be borne by ETF holders. There are suspicions that IBIT has become a target of the attack.
Meanwhile, funds are flowing into IBIT. Huobi co-founder Du Jun stated that family offices he configured BTC for years ago, after experiencing exchange hacks and cold wallet supply chain security incidents, have all converted BTC into IBIT, with some directly selling coins to buy physical gold. Some crypto investors believe that holding Bitcoin spot is a more reliable choice.
VI. The controversy over freezing rights resurfaces, and the boundaries of on-chain intervention are under scrutiny
When both the private key and process may be compromised, on-chain freezing has become an important means of recovering assets.
On the morning of the 30th at 8:19 AM, Arbitrum issued a statement saying that its security committee had taken emergency action to transfer 74,559,805 ARB and 8,425 ETH from an address related to the Binance attack on Arbitrum One into an intermediate frozen wallet, valued at about $30 million.
These assets can only be operated further by the security committee or accessed through governance voting by Arbitrum DAO.
Some analysts pointed out that the security committee temporarily upgraded a system contract to execute the transfer in the name of the attacker's address, and then restored the original implementation, all without requiring the attacker's signature.
According to Arbitrum's charter, such emergency actions require approval from at least 9 of the 12 committee members. In April of this year, Arbitrum froze 30,766 ETH in the KelpDAO theft case in the same manner, both times targeting funds attributed to North Korea.
On-chain analyst Yu Jin joked that the hacker might not have expected Arbitrum could directly transfer money from his wallet. The act of freezing itself has sparked further debate.
Supporters believe that freezing the hacker's assets is justified. Crypto analyst yyy stated that the purpose of decentralization is to combat power and serve the public. If centralized means are used to help the public, it is commendable, and freezing the hacker's assets falls into this category.
Skeptics mainly focus on the boundaries of power. Crypto researcher CyberSatoshi believes that ETH on the Ethereum mainnet is immutable, but balances on Rollup are managed by a 12-of-9 multisig, and the sovereignty of L2 assets depends on the administrator keys controlling the cross-chain bridge. Some analysts have also raised the question of under what circumstances blockchain governance should have the power to forcibly transfer assets without the owner's signature, which still requires clearer boundaries.
After the freeze, the question of who owns the assets is also a dilemma. The ETH frozen in the KelpDAO case was originally planned to be used to compensate affected users, but in early May, a group of creditors with terrorism judgments against North Korea, who had not yet been compensated, applied for a restraining order in a U.S. court, claiming that this ETH belongs to property rights enjoyed by North Korea. On May 8, the Southern District of New York federal court allowed Arbitrum DAO to vote to transfer the assets to Aave LLC, but the restraining order was transferred along with the assets, and the court reserved judgment on the core dispute.
As of the time of publication, Binance withdrawals have not yet resumed, and it is expected to restart on November 1 according to the official timeline. When the proof of reserves and technical review report will be released, when the remaining BTC and ETH will start to move, and how the approximately $3 billion in frozen assets will ultimately be allocated, remain to be seen in future developments.