Binance explained how $6.3 billion was withdrawn from the exchange. Exchange co-lead Richard Teng said no traces of private key leakage were found. But 11 hot wallet keys still signed transfers to the attacker's address.
A private key is a secret access code to a wallet. A hot wallet is connected to the network so the exchange can pay clients quickly.
Withdrawals from Binance are still halted. Clients' money sits on the exchange's infrastructure, and it cannot be disposed of right now.
What did the theft itself look like?
The bulk was withdrawn in about 20 minutes. The attacker's wallets ended up on ten blockchains.
- 23:24 MSK - 167,464 ETH, 1.615 billion USDT and about 60 other tokens left Binance 14 wallet, roughly $2.5 billion in a single transaction
- 1 ETH - all that remained in this wallet
- 24 seconds later - Binance 16 was emptied: 28,005 ETH, 55.7 million USDT, 84.5 WBTC
- $780 million USDC - withdrawn from a Circle smart account
- $6.3 billion - the total
Why did one attempt out of 50 work?
According to a report by security company Blockaid, at 23:20:59 MSK the attacker sent a transaction with 50 delegation authorizations at once. This is a permission by which a wallet starts executing commands from another address.
- Consecutive numbers. The authorizations were for sequential numbers from 18,914,775 to 18,914,824.
- The wallet lived its own life. It kept paying clients, so guessing the current number was impossible.
- One match. 49 attempts were rejected, one matched.
- Collection of funds. Began 3 minutes 24 seconds later.
Who is behind this?
The attack was prepared in advance. The attacker's address was funded with three withdrawals through the Tornado Cash anonymizer on October 28. The scenario was tested on three of their own wallets with transfers of $2-6.
The entry point was an engineer's infected laptop, says Binance. Teng clarifies: it was not "one click," and no blame is placed on a specific employee.
- TRM Labs and Chainalysis - link the attack with high confidence to the TraderTraitor group
What will happen to clients' money?
About $3 billion is frozen. The attacker retains roughly $2.86 billion. The exchange promises to cover the losses from the SAFU fund and its own funds.
- Deposits. Operating as normal.
- Withdrawals. Planned to be restored within 48 hours from 07:17 MSK.
- After that. An updated proof of reserves and a technical breakdown are promised.
The main point: money on an exchange is available exactly as long as its infrastructure works. You can learn how a prop company account works in the academy.
Did you check today whether money can be withdrawn?
The worst thing about news like this is not even the chart, but the withdraw button that hasn't worked for two days. The arithmetic is simple. You can only trade with what you deposited yourself, and all of it sits on someone else's infrastructure. Prop trading changes the very scheme: the account is opened and funded by the prop company, your money goes only to pay for the evaluation, and the risk on the account is held by its limits. It makes more sense to understand how this works before the next such morning.