SourcesFilm 14
Twenty Minutes
On YouTube as “How Binance Saw The Hackers Coming And Still Lost $6 Billion”
Corrections and updates
- The film says Binance’s withdrawals were still shut as we finished it. Since then Binance has reopened withdrawals; The Currency Analytics reports about $2 billion in customer withdrawals after the reopening, separate from the stolen coins (1 Nov 2026): thecurrencyanalytics.com
Twenty Minutes
-
Binance’s own account of when it started
The breach began “at around 2026-10-29 20:05 (UTC)”, a Thursday evening
-
The FBI named North Korea for the previous record, about $1.5 billion stolen from Bybit
“FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor.’”
They Knew
-
The fake-recruiter method, described in 2022
Messages “often mimic a recruitment effort and offer high-paying jobs”, sent to “employees of cryptocurrency companies—often working in system administration or software development/IT operations (DevOps)” (18 Apr 2022, revised 20 Apr 2022)
-
Binance’s security chief Jimmy Su
“The largest vector currently against the crypto industry is state actors, particularly in the DPRK, [with] Lazarus.”; “Su is confident that DPRK attackers are messaging Binance employees on LinkedIn every day”
-
Bybit’s Ben Zhou on the signature and the call from his finance chief
“after I signed the transaction about 30 minutes later he called me”; the wallet held about 400,000 ether; “online signing use a browser right which makes it not really cold”
-
Zhou’s account the day of the theft
“During a routine transfer from the cold wallet to the hot wallet, the transaction was carried out using a multisig…through the Safe service.”
-
Safe on how Bybit was hit: “a compromised Safe{Wallet} developer machine”
-
Lazarus got in through a breached Safe developer machine, and the signers saw a legitimate-looking transaction while different data was sent for signing
The Door
-
Binance’s first explanation, posted 02:25 UTC
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”
-
The walk-back, posted 08:47 UTC, about six hours later
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”
-
User assets “are only moved into a hot wallet when a user makes a withdrawal”; on the Ethereum permission: “That delegation did not pass through our normal approval controls.”
-
Binance’s warning two days before the theft about North Korea’s “Contagious Interview” campaign
Such attacks “may exploit everyday scenarios such as job interviews, coding tests, and software installations.”
-
Tornado Cash funding at least 36 hours before the theft, code tested on two wallets, then “it rehearsed the final version on a third wallet, then routed the test funds back to itself”; “Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”
-
The twenty minutes, chain by chain
“Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP”; Solana and Optimism “shortly after 20:10 UTC”; “At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC”; “Ethereum accounts for about USD 3.79 billion”; the $6.36 billion total includes a second wave at 23:05 UTC
The Way Out
-
“the attacker now controls around $3.21 billion of assets that cannot be frozen by an issuer” (30 Oct 2026, updated 31 Oct 2026)
-
“a trading firm fills it from its own stock or from pools”; two fillers, 0xbeef…c555 (145M USDT) and 0x0000…e69d (100M USDT), took most of it; “Traders & arbitrage bots kept: $59.9M after costs”
-
Filler 0xbeef…c555, looked up by us
No public name tag (marked only “Authority”), 68,716 transactions, activity on the account the day we checked
-
With the loan near liquidation, Aave “unfroze all markets across its V3 and V4 protocols”
-
“USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the @binance hack.”
-
World Liberty Financial, issuer of USD1, is “affiliated with President Trump and family members”
-
A payment order spelled “fandation” for “foundation”; “the routing bank flagged the error and sought clarification”, stopping a $20 million transfer, while “$81 million successfully moved” to the Philippines
No Cost
-
Jon Chang Hyok, Kim Il and Park Jin Hyok, “members of the Reconnaissance General Bureau”; “The hackers extorted or stole more than $1.3 billion in cash and cryptocurrency”
-
Anne Neuberger, then deputy national security adviser
“The North Koreans are funding … half of their missile program by crypto heists and cyber efforts”
The Pipe
-
"[w]e have been tracking some stolen money that is coming from one of the worst hacking groups we have seen (more than $130m in stolen funds). They seem to be using Binance as one of the cash out venues…”
-
Trump’s stablecoin USD1 used in the $2 billion Binance deal via the Abu Dhabi firm MGX; Zach Witkoff
“USD1 has been selected as the official stablecoin to close MGX’s $2 billion investment in Binance.”
-
The White House: Trump “exercised his constitutional authority by issuing a pardon for Mr. Zhao”
-
“Eventually North Korea turns these stolen funds over to professional money-laundering networks.”
-
Withdrawals “within approximately 34 hours, subject to the completion of security checks”, the “initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02”, and a “detailed technical report outlining what happened”
-
The stolen bitcoin in 19 addresses
“Seventeen held exactly 1,000 BTC each, with the other two holding about 833 BTC and 438 BTC”; our own check on 1 November 2026 found all 19 still unspent
Interviews and clips quoted
-
“every single thing that is being deposited into Binance right now is being withdrawn into the hackers’ wallets.”
-
Adrian Olsen, retail trader: “It’s totally gone. None of it left”
-
Ari Redbord, global head of policy, TRM Labs
“the largest hack, really the largest theft of anything in human history.” (29–30 Oct 2026)
-
Jimmy Su, chief security officer, Binance
“we are still seeing most of the frauds that are not necessarily finding exploits in the code or the technology, but the biggest vulnerability is often the human trust”
-
Ben Zhou, co-founder and CEO, Bybit
“And that’s when his voice starts shaking … He says, ‘No, no, no, Ben. It seems like it’s the whole wallet.’”
-
Ben Zhou, co-founder and CEO, Bybit
“But why did we choose to use a solution that involves a browser signing?”
-
“This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop.”
-
“they submitted 50 EIP-7702 authorizations in a single transaction hoping that one would land and one did”
-
“We never use any customer funds, so they are not impacted. What was affected in this incident was Binance’s own hot wallet.”
-
“they will deposit it on a borrowing and lending platform like Aave and then borrow against it and then move those borrowed funds. And that’s how they can get around some of the freezing aspects.”
-
Ari Redbord, global head of policy, TRM Labs
“Tether and Circle were able to freeze 40% of the stolen funds last night, about 2.4 billion within an hour or so of the hack.”
-
Philippine senator, Senate Blue Ribbon Committee hearing on RCBC
“if you honor the stop payment order request on February 9, according to the records I have, 58 million, or more than one half of the funds, would not have been released.”
-
David Maxwell, retired US Army colonel and Korea expert
“They are groomed to be able to conduct cyber activities for the military or for the Reconnaissance General Bureau.” (filmed c. 2019–20, uploaded 12 Apr 2025)
-
Ari Redbord, global head of policy, TRM Labs
“So they care a lot less about getting caught because no one’s going to jail. There’s never going to be an extradition.”
-
Ari Redbord, global head of policy, TRM Labs
“This is not a criminal per se, this is a criminal state. So we need to use every national security tool at our disposal.”
-
Anne Neuberger, then Deputy National Security Adviser for cyber and emerging technology, White House
“the North Koreans fundamentally are funding, we estimate, half of their missile program”
-
Anne Neuberger, then Deputy National Security Adviser for cyber and emerging technology, White House
“launching 60 to 70 missiles last year, more already this year than in many prior years. How do we raise awareness to say the funding for that is coming from this source”
-
Merrick Garland, US Attorney General
“by failing to comply with US law Binance made it easy for criminals to move their stolen funds and illicit proceeds on its exchanges”
-
Merrick Garland, US Attorney General
“As Zhao himself said in a September 2019 chat, quote, if we blocked U.S. users from day one, Binance will not be as big as we are today.”
-
“I want to be clear, we are committed to covering all hacked losses through our company funds. Your assets are safe.”