| Crypto Enthusiast| 🎖️$Ansem Ambassador🐂🀄️♉| Donation: Solana address - HTpdTQfKYL5hWkAmTQQw2iEqJG6vLuoNcthqgRxSfXpe
Loveworld Nation
Joined May 2009
- Tweets9.6K
- Following3.7K
- Followers1K
- Likes18.8K
Pinned Tweet
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.
RSM 🐂🀄️ retweeted
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
Yeah, that was needed. The whole @ansem handle situation had been messy for a while — @blknoiz06 posted back in August that he’d acquired it (and said the previous owner just gave it to him), then later the account was clearly not under his control, posting disclaimers that it isn’t him, and in some cases dropping CAs that people were aping into thinking it was the real Ansem.
In this clip from the @MarketBubble stream shows him finally addressing it directly, which lines up with the community take that the original owner still has (or regained) access and the account isn’t safe to follow for calls.
In CT, especially around a coin like $ANSEM, that kind of ambiguity is dangerous. People see the handle and assume it’s him. Clearing the air on stream, even if the mechanics of how control flipped back are still a bit fuzzy to some, at least reduces the confusion.
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
Yeah, that was needed. The whole @ansem handle situation had been messy for a while — @blknoiz06 posted back in August that he’d acquired it (and said the previous owner just gave it to him), then later the account was clearly not under his control, posting disclaimers that it isn’t him, and in some cases dropping CAs that people were aping into thinking it was the real Ansem.
In this clip from the @MarketBubble stream shows him finally addressing it directly, which lines up with the community take that the original owner still has (or regained) access and the account isn’t safe to follow for calls.
In CT, especially around a coin like $ANSEM, that kind of ambiguity is dangerous. People see the handle and assume it’s him. Clearing the air on stream, even if the mechanics of how control flipped back are still a bit fuzzy to some, at least reduces the confusion.
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
Binance didn’t just survive — it rewrote the scale of global markets.
In 2017, fewer than 6 million people owned crypto. Today there are ~741 million holders worldwide. 323 million of them (about 43%) use Binance — roughly 1 in every 27 people on Earth has a Binance account.
The volume is almost hard to process:
- Lifetime trading volume: $156.4 trillion. That exceeds the combined annual GDP of the United States, China, Japan, Germany, and the UK.
- 2025 alone: $34 trillion across all products (~$93 billion per day). Spot alone was $7.1T+.
- First half of 2026: another **$11.4 trillion added (a 7.8% jump on the all-time total in just six months).
Market dominance is extreme:
- Spot share among top-10 exchanges hit 42.7% in Q3 2026. No other exchange was above 10%. Binance’s H1 spot volume was ~4.5× the next-largest venue.
- Derivatives share has sat in the 41–45% range.
- On many days it processes nearly half of all global Bitcoin and Ethereum volume.
The expansion beyond pure crypto is the real plot twist. TradFi products (stocks, ETFs, tokenized securities, perpetuals) have been doing $80B+ in monthly volume since March 2026. Tokenized stock trading share went from 18% to 74% in a matter of months. Direct stock trading hit $1B AUM in its first month.
Revenue estimates put Binance in the $16–17 billion range annually — more than double Coinbase’s recent run-rate — while it continues adding institutional users (up 9% in H1 2026) even in softer markets.
From a regulatory and reputational low point to controlling nearly half the crypto trading stack, a user base larger than most countries, and a volume number that now exceeds the GDP of the world’s biggest economies combined — this is what a full-scale comeback looks like in numbers.
RSM 🐂🀄️ retweeted
Binance didn’t just survive — it rewrote the scale of global markets.
In 2017, fewer than 6 million people owned crypto. Today there are ~741 million holders worldwide. 323 million of them (about 43%) use Binance — roughly 1 in every 27 people on Earth has a Binance account.
The volume is almost hard to process:
- Lifetime trading volume: $156.4 trillion. That exceeds the combined annual GDP of the United States, China, Japan, Germany, and the UK.
- 2025 alone: $34 trillion across all products (~$93 billion per day). Spot alone was $7.1T+.
- First half of 2026: another **$11.4 trillion added (a 7.8% jump on the all-time total in just six months).
Market dominance is extreme:
- Spot share among top-10 exchanges hit 42.7% in Q3 2026. No other exchange was above 10%. Binance’s H1 spot volume was ~4.5× the next-largest venue.
- Derivatives share has sat in the 41–45% range.
- On many days it processes nearly half of all global Bitcoin and Ethereum volume.
The expansion beyond pure crypto is the real plot twist. TradFi products (stocks, ETFs, tokenized securities, perpetuals) have been doing $80B+ in monthly volume since March 2026. Tokenized stock trading share went from 18% to 74% in a matter of months. Direct stock trading hit $1B AUM in its first month.
Revenue estimates put Binance in the $16–17 billion range annually — more than double Coinbase’s recent run-rate — while it continues adding institutional users (up 9% in H1 2026) even in softer markets.
From a regulatory and reputational low point to controlling nearly half the crypto trading stack, a user base larger than most countries, and a volume number that now exceeds the GDP of the world’s biggest economies combined — this is what a full-scale comeback looks like in numbers.
RSM 🐂🀄️ retweeted
Yeah, that was needed. The whole @ansem handle situation had been messy for a while — @blknoiz06 posted back in August that he’d acquired it (and said the previous owner just gave it to him), then later the account was clearly not under his control, posting disclaimers that it isn’t him, and in some cases dropping CAs that people were aping into thinking it was the real Ansem.
In this clip from the @MarketBubble stream shows him finally addressing it directly, which lines up with the community take that the original owner still has (or regained) access and the account isn’t safe to follow for calls.
In CT, especially around a coin like $ANSEM, that kind of ambiguity is dangerous. People see the handle and assume it’s him. Clearing the air on stream, even if the mechanics of how control flipped back are still a bit fuzzy to some, at least reduces the confusion.
Binance didn’t just survive — it rewrote the scale of global markets.
In 2017, fewer than 6 million people owned crypto. Today there are ~741 million holders worldwide. 323 million of them (about 43%) use Binance — roughly 1 in every 27 people on Earth has a Binance account.
The volume is almost hard to process:
- Lifetime trading volume: $156.4 trillion. That exceeds the combined annual GDP of the United States, China, Japan, Germany, and the UK.
- 2025 alone: $34 trillion across all products (~$93 billion per day). Spot alone was $7.1T+.
- First half of 2026: another **$11.4 trillion added (a 7.8% jump on the all-time total in just six months).
Market dominance is extreme:
- Spot share among top-10 exchanges hit 42.7% in Q3 2026. No other exchange was above 10%. Binance’s H1 spot volume was ~4.5× the next-largest venue.
- Derivatives share has sat in the 41–45% range.
- On many days it processes nearly half of all global Bitcoin and Ethereum volume.
The expansion beyond pure crypto is the real plot twist. TradFi products (stocks, ETFs, tokenized securities, perpetuals) have been doing $80B+ in monthly volume since March 2026. Tokenized stock trading share went from 18% to 74% in a matter of months. Direct stock trading hit $1B AUM in its first month.
Revenue estimates put Binance in the $16–17 billion range annually — more than double Coinbase’s recent run-rate — while it continues adding institutional users (up 9% in H1 2026) even in softer markets.
From a regulatory and reputational low point to controlling nearly half the crypto trading stack, a user base larger than most countries, and a volume number that now exceeds the GDP of the world’s biggest economies combined — this is what a full-scale comeback looks like in numbers.
Yeah, that was needed. The whole @ansem handle situation had been messy for a while — @blknoiz06 posted back in August that he’d acquired it (and said the previous owner just gave it to him), then later the account was clearly not under his control, posting disclaimers that it isn’t him, and in some cases dropping CAs that people were aping into thinking it was the real Ansem.
In this clip from the @MarketBubble stream shows him finally addressing it directly, which lines up with the community take that the original owner still has (or regained) access and the account isn’t safe to follow for calls.
In CT, especially around a coin like $ANSEM, that kind of ambiguity is dangerous. People see the handle and assume it’s him. Clearing the air on stream, even if the mechanics of how control flipped back are still a bit fuzzy to some, at least reduces the confusion.
RSM 🐂🀄️ retweeted
How @binance Handled the Biggest Crypto Hack Ever — And Why It Actually Mattered
On the evening of October 29, 2026, something went very wrong at Binance. In roughly twenty to thirty minutes, an attacker drained somewhere between $6.15 and $6.3 billion from the exchange’s hot wallets across multiple chains. It was, by a wide margin, the largest crypto theft on record. Blockchain firms TRM Labs and Chainalysis quickly tied it to TraderTraitor, a North Korean group linked to the broader Lazarus cluster. The FBI later confirmed the attribution. The entry point appears to have been a compromised laptop belonging to a DevOps engineer, which gave the attacker a foothold into a service container and the ability to submit unauthorized withdrawals. On Ethereum they used the relatively new EIP-7702 feature to temporarily turn a normal wallet into something that could execute their own code. They even built in self-destruct mechanisms so tools and traces would vanish behind them. Importantly, Binance said it found no evidence that any private keys themselves had been stolen.
What happened next is the part that still stands out. Instead of the usual cycle of delayed admissions and vague assurances, Binance moved fast, spoke clearly, and put users first in a way that was concrete rather than rhetorical.
Their security and wallet teams spotted the anomaly and started containing it before the top executives were even fully in the loop. Yi He later noted that the 24/7 teams were already working when she saw the large transfers on @X and joined the call. Within minutes a cross-border war room of about a hundred people had formed. Withdrawals were paused so the remaining assets could be locked down and the systems rebuilt and retested. Hot wallets — the ones that hold funds ready for daily withdrawals — were the ones hit. The bulk of customer assets sit in cold storage and only move into hot wallets when someone actually wants to withdraw. Binance was explicit: customer funds were never used, and users would not bear the loss.
They backed that up with money. The exchange set aside more than $6.34 billion of its own funds, with roughly $5 billion already sitting in the exact tokens that had been stolen (BTC, ETH, BNB, USDT, USDC and others). By the end of October 31 they had replenished about 90 percent of the stolen amount through a mix of market buys and OTC deals. The major tokens were fully backed again. They drew on a portion of the long-standing SAFU emergency fund (including a visible transfer of thousands of BTC), some of the futures insurance fund, and corporate treasury. They also promised to refill SAFU back toward the $1 billion level. A new proof-of-reserves snapshot was taken, and a full zero-knowledge proof was in the works so users could verify the numbers themselves.
The people leading the public side of the response were the co-CEOs @_RichardTeng and @heyibinance, with founder Changpeng Zhao (@cz_binance ) still visible as a major shareholder.
CZ, who no longer runs day-to-day operations, was one of the first prominent voices to say the obvious out loud: “User funds are safe.” He thanked Tether and Circle for moving quickly to freeze more than $1.5 billion combined in USDT and USDC, and he said that as a shareholder he expected every user to be made whole. It was a short, steady message at a moment when markets were dropping and rumors were flying.
Richard Teng, the former regulator who has been co-CEO since late 2023 (and sole CEO before Yi He joined him in the dual role), recorded a direct video. He walked through what was known: the attack was more complex than a single laptop, there was no private-key leak, customer assets were untouched, and the company would cover every dollar from its own resources. He laid out the practical next steps — rebuild and retest the withdrawal systems, finish buying the remaining tokens, publish proof of reserves, and keep working with law enforcement and partners. 👇
How @binance Handled the Biggest Crypto Hack Ever — And Why It Actually Mattered
On the evening of October 29, 2026, something went very wrong at Binance. In roughly twenty to thirty minutes, an attacker drained somewhere between $6.15 and $6.3 billion from the exchange’s hot wallets across multiple chains. It was, by a wide margin, the largest crypto theft on record. Blockchain firms TRM Labs and Chainalysis quickly tied it to TraderTraitor, a North Korean group linked to the broader Lazarus cluster. The FBI later confirmed the attribution. The entry point appears to have been a compromised laptop belonging to a DevOps engineer, which gave the attacker a foothold into a service container and the ability to submit unauthorized withdrawals. On Ethereum they used the relatively new EIP-7702 feature to temporarily turn a normal wallet into something that could execute their own code. They even built in self-destruct mechanisms so tools and traces would vanish behind them. Importantly, Binance said it found no evidence that any private keys themselves had been stolen.
What happened next is the part that still stands out. Instead of the usual cycle of delayed admissions and vague assurances, Binance moved fast, spoke clearly, and put users first in a way that was concrete rather than rhetorical.
Their security and wallet teams spotted the anomaly and started containing it before the top executives were even fully in the loop. Yi He later noted that the 24/7 teams were already working when she saw the large transfers on @X and joined the call. Within minutes a cross-border war room of about a hundred people had formed. Withdrawals were paused so the remaining assets could be locked down and the systems rebuilt and retested. Hot wallets — the ones that hold funds ready for daily withdrawals — were the ones hit. The bulk of customer assets sit in cold storage and only move into hot wallets when someone actually wants to withdraw. Binance was explicit: customer funds were never used, and users would not bear the loss.
They backed that up with money. The exchange set aside more than $6.34 billion of its own funds, with roughly $5 billion already sitting in the exact tokens that had been stolen (BTC, ETH, BNB, USDT, USDC and others). By the end of October 31 they had replenished about 90 percent of the stolen amount through a mix of market buys and OTC deals. The major tokens were fully backed again. They drew on a portion of the long-standing SAFU emergency fund (including a visible transfer of thousands of BTC), some of the futures insurance fund, and corporate treasury. They also promised to refill SAFU back toward the $1 billion level. A new proof-of-reserves snapshot was taken, and a full zero-knowledge proof was in the works so users could verify the numbers themselves.
The people leading the public side of the response were the co-CEOs @_RichardTeng and @heyibinance, with founder Changpeng Zhao (@cz_binance ) still visible as a major shareholder.
CZ, who no longer runs day-to-day operations, was one of the first prominent voices to say the obvious out loud: “User funds are safe.” He thanked Tether and Circle for moving quickly to freeze more than $1.5 billion combined in USDT and USDC, and he said that as a shareholder he expected every user to be made whole. It was a short, steady message at a moment when markets were dropping and rumors were flying.
Richard Teng, the former regulator who has been co-CEO since late 2023 (and sole CEO before Yi He joined him in the dual role), recorded a direct video. He walked through what was known: the attack was more complex than a single laptop, there was no private-key leak, customer assets were untouched, and the company would cover every dollar from its own resources. He laid out the practical next steps — rebuild and retest the withdrawal systems, finish buying the remaining tokens, publish proof of reserves, and keep working with law enforcement and partners. 👇
The tone was calm and specific rather than defensive.
Yi He, co-founder, co-CEO, and Chief Customer Service Officer, also recorded a video (in Chinese, later translated). She thanked the industry for helping freeze roughly $3 billion, noted that the affected amount was only about 2 percent of total user assets and public reserves, and said Binance would use its own funds to make the books match again so users stayed fully backed 1:1. She emphasized that the security teams had already been on it, and she framed the episode as a moment that showed the industry could still pull together. She was seven months pregnant at the time and still joined the overnight calls.
Outside the company, the response was unusually coordinated. Tether and Circle froze large stablecoin balances within the first hour. Other issuers and even Arbitrum’s Security Council contributed additional freezes. Analytics firms traced the flows in real time. Law enforcement, including the FBI, was involved early. The result was that roughly $3 billion was locked on-chain before the attacker could fully convert or move it into harder-to-recover assets. That kind of speed is not automatic; it depends on relationships and prepared processes that were already in place.
None of this erases the fact that a sophisticated state-linked actor got in, or that endpoint security and signing controls clearly need more work. What it does show is that a large exchange can absorb a multi-billion-dollar hit without making users the residual claimants, communicate in plain language while the work is still underway, and lean on both its own balance sheet and a wider set of industry partners. SAFU, the proof-of-reserves process, the 24/7 response teams, and the willingness to say “we’re covering this” on day one all mattered.
In a space that has seen plenty of exchanges disappear or leave customers holding the bag, Binance’s handling of this one was a reminder that size, preparation, and a deliberate choice to put users first can still make a difference when the worst happens. The funds stayed SAFU — not as a slogan, but as an outcome that was paid for in real time.
RSM 🐂🀄️ retweeted
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.
RSM 🐂🀄️ retweeted
I admire the fact that @cz_binance is not silent and refuses to entertain any form of trolling or weakness. He has kept us informed and continues to provide updates. This kind of leader is not easy to defeat. He knows his craft thoroughly and does not back down.
“Never give in. Never give in. Never, never, never, never—in nothing, great or small, large or petty—never give in except to convictions of honour and good sense.” — Winston Churchill
I admire the fact that @cz_binance is not silent and refuses to entertain any form of trolling or weakness. He has kept us informed and continues to provide updates. This kind of leader is not easy to defeat. He knows his craft thoroughly and does not back down.
“Never give in. Never give in. Never, never, never, never—in nothing, great or small, large or petty—never give in except to convictions of honour and good sense.” — Winston Churchill
RSM 🐂🀄️ retweeted
2️⃣ Key Vulnerabilities or Security Weaknesses
- Privileged endpoint (engineer laptop) compromise leading to internal access.
- A service/container with sufficient privileges to request or submit withdrawal signatures from the hot-wallet signing system.
- Concentration of large balances in hot wallets across many chains, enabling rapid multi-chain extraction once signing access was obtained.
- Reliance on systems that could produce valid signatures without key extraction (or without sufficient multi-party/time-delay controls for large or anomalous requests).
- EIP-7702 amplification once an authorization was signed, turning a normal wallet into an attacker-controlled sweeper.
These are classic issues in high-value crypto custody: the human/endpoint and internal authorization path became the weak link, not on-chain cryptography.
Impact
- Financial: ~$6.3–6.36 billion transferred. Roughly $2.7 billion frozen (mainly stablecoins by Tether, Circle, Ripple, World Liberty Financial, and others, plus some Arbitrum assets). The attacker retains substantial holdings beyond freeze reach—TRM reported more than 420,000 ETH and 18,270 BTC (~$2.4 billion at the time of assessment), plus smaller amounts. Some freezable assets were swapped or used in lending before freezes landed.
- Binance users: Protected by the coverage pledge (SAFU historically ~$1 billion scale, now primarily ~15,000 BTC plus company funds). Temporary withdrawal suspension and market volatility (crypto prices dropped; liquidations occurred).
- Broader communities/market: Heightened concern about exchange operational security and state-sponsored thefts that can fund North Korean programs. Rapid industry coordination limited the net loss, but non-freezable assets (ETH/BTC) remain harder to recover.
The separate late-September/early-October 2026 incidents involving South Korean banks (CrowdStrike: likely Chinese-speaking financially motivated actor using the Chinese open-source ARTEX AI pentesting tool plus various LLMs) are unrelated based on available public reporting.
Response and Recovery Measures
Binance suspended withdrawals (with expected resumption after security checks, reported in the ~48-hour range from early statements), revoked affected authorizations, engaged law enforcement and blockchain intelligence partners, and coordinated freezes. Stablecoin issuers and network participants acted quickly. The exchange has committed to covering all losses and publishing an updated Proof of Reserves after remediation, plus a detailed post-mortem once facts are verified. Ongoing fund tracking continues via firms like TRM (Beacon Network) and others.
Key Cybersecurity Lessons and Recommended Controls
- Protect the signing path, not just keys: Enforce strict least-privilege, segmentation, and multi-party/approval gates for any system that can request or generate hot-wallet signatures. Monitor for anomalous signing requests, especially cross-chain or large-value.
- Endpoint and privileged-user security: Strong EDR, application control, phishing-resistant MFA, and regular privileged-access reviews. Treat engineer laptops with production-adjacent access as high-value targets.
- Hot-wallet hygiene: Minimize balances (frequent sweeps to cold storage), tier wallets, and apply rate/velocity limits plus independent approvals for large withdrawals.
- Detect advanced features: Monitor for unexpected EIP-7702 delegations or similar account-abstraction changes on operational wallets.
- Preparation and response: Assume sophisticated, patient adversaries (state-sponsored groups excel at staging and multi-chain simultaneous moves). Maintain pre-established freeze/coordination channels with issuers and intelligence firms. Rapid response and insurance/reserves (like SAFU) matter for user confidence.
- Defense in depth against social engineering and initial access: North Korea-linked groups repeatedly succeed via employee targeting.
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.
RSM 🐂🀄️ retweeted
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
The real problem in that @cz_binance post isn’t that exchanges sometimes get breached. It’s that they have to collect your name, email, phone, and ID in the first place, then store it all in one place. When that pile leaks, scammers get a ready-made list of who holds what and how to contact them.
@BullpenFi sidesteps most of that. It’s non-custodial. Your keys are generated inside a secure enclave (Turnkey) and never leave it. Bullpen itself can’t touch the funds or freeze them. You can connect a normal wallet like @phantom if you want, or just use the one it creates, and you can export the key whenever. You’re not depositing into some account that also knows your real identity.
That removes the biggest reason those leaks are dangerous: the platform no longer holds both your money and a detailed profile of you. You’re still responsible for not clicking random links or approving sketchy contracts, but you’re no longer depending on some exchange’s vendors to keep your personal data safe. That’s the practical difference.
RSM 🐂🀄️ retweeted
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.
Bull morning 🐂
Payday is here🚀🚀🚀
Another day to be grateful. Let's go MAKE $ANSEM GREAT AGAIN.
The real problem in that @cz_binance post isn’t that exchanges sometimes get breached. It’s that they have to collect your name, email, phone, and ID in the first place, then store it all in one place. When that pile leaks, scammers get a ready-made list of who holds what and how to contact them.
@BullpenFi sidesteps most of that. It’s non-custodial. Your keys are generated inside a secure enclave (Turnkey) and never leave it. Bullpen itself can’t touch the funds or freeze them. You can connect a normal wallet like @phantom if you want, or just use the one it creates, and you can export the key whenever. You’re not depositing into some account that also knows your real identity.
That removes the biggest reason those leaks are dangerous: the platform no longer holds both your money and a detailed profile of you. You’re still responsible for not clicking random links or approving sketchy contracts, but you’re no longer depending on some exchange’s vendors to keep your personal data safe. That’s the practical difference.
2️⃣ Key Vulnerabilities or Security Weaknesses
- Privileged endpoint (engineer laptop) compromise leading to internal access.
- A service/container with sufficient privileges to request or submit withdrawal signatures from the hot-wallet signing system.
- Concentration of large balances in hot wallets across many chains, enabling rapid multi-chain extraction once signing access was obtained.
- Reliance on systems that could produce valid signatures without key extraction (or without sufficient multi-party/time-delay controls for large or anomalous requests).
- EIP-7702 amplification once an authorization was signed, turning a normal wallet into an attacker-controlled sweeper.
These are classic issues in high-value crypto custody: the human/endpoint and internal authorization path became the weak link, not on-chain cryptography.
Impact
- Financial: ~$6.3–6.36 billion transferred. Roughly $2.7 billion frozen (mainly stablecoins by Tether, Circle, Ripple, World Liberty Financial, and others, plus some Arbitrum assets). The attacker retains substantial holdings beyond freeze reach—TRM reported more than 420,000 ETH and 18,270 BTC (~$2.4 billion at the time of assessment), plus smaller amounts. Some freezable assets were swapped or used in lending before freezes landed.
- Binance users: Protected by the coverage pledge (SAFU historically ~$1 billion scale, now primarily ~15,000 BTC plus company funds). Temporary withdrawal suspension and market volatility (crypto prices dropped; liquidations occurred).
- Broader communities/market: Heightened concern about exchange operational security and state-sponsored thefts that can fund North Korean programs. Rapid industry coordination limited the net loss, but non-freezable assets (ETH/BTC) remain harder to recover.
The separate late-September/early-October 2026 incidents involving South Korean banks (CrowdStrike: likely Chinese-speaking financially motivated actor using the Chinese open-source ARTEX AI pentesting tool plus various LLMs) are unrelated based on available public reporting.
Response and Recovery Measures
Binance suspended withdrawals (with expected resumption after security checks, reported in the ~48-hour range from early statements), revoked affected authorizations, engaged law enforcement and blockchain intelligence partners, and coordinated freezes. Stablecoin issuers and network participants acted quickly. The exchange has committed to covering all losses and publishing an updated Proof of Reserves after remediation, plus a detailed post-mortem once facts are verified. Ongoing fund tracking continues via firms like TRM (Beacon Network) and others.
Key Cybersecurity Lessons and Recommended Controls
- Protect the signing path, not just keys: Enforce strict least-privilege, segmentation, and multi-party/approval gates for any system that can request or generate hot-wallet signatures. Monitor for anomalous signing requests, especially cross-chain or large-value.
- Endpoint and privileged-user security: Strong EDR, application control, phishing-resistant MFA, and regular privileged-access reviews. Treat engineer laptops with production-adjacent access as high-value targets.
- Hot-wallet hygiene: Minimize balances (frequent sweeps to cold storage), tier wallets, and apply rate/velocity limits plus independent approvals for large withdrawals.
- Detect advanced features: Monitor for unexpected EIP-7702 delegations or similar account-abstraction changes on operational wallets.
- Preparation and response: Assume sophisticated, patient adversaries (state-sponsored groups excel at staging and multi-chain simultaneous moves). Maintain pre-established freeze/coordination channels with issuers and intelligence firms. Rapid response and insurance/reserves (like SAFU) matter for user confidence.
- Defense in depth against social engineering and initial access: North Korea-linked groups repeatedly succeed via employee targeting.
1️⃣ BINANCE HACK
@cz_binance
@BinanceWallet
On October 29, 2026, attackers drained approximately $6.3–6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes (starting ~20:05 UTC), making it the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit hack of February 2025.
Binance has confirmed a security incident, estimated the impact at ~$6.3 billion, and stated that ~$3 billion has been frozen on-chain. It has pledged to cover all losses via its SAFU (Secure Asset Fund for Users) fund and company reserves, with user funds described as safe. Deposits were largely unaffected; withdrawals were suspended as a precaution while the exchange revamps related systems. A full technical post-mortem is pending.
Background of the Incident
Most funds moved in a compressed window across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Ethereum accounted for the largest share (~$3.79 billion per TRM Labs, including large USDT/USDC amounts and ~200k+ ETH). Other notable outflows included ~18,270 BTC and substantial USDT on Tron and other chains. Preparations began at least 36 hours earlier, including Tornado Cash withdrawals to fund an operator wallet, code deployment/testing, and rehearsals.
No blockchain protocol or cryptography was broken. The activity involved authorized-looking transfers from Binance’s operational (hot) wallets.
Threat Actor and Attack Method
TRM Labs attributes the operation with high confidence to "TraderTraitor", North Korea’s elite hacking unit (linked to the broader Lazarus Group). This matches patterns from prior incidents, including the FBI-attributed $1.5 billion Bybit hack and the April 2026 KelpDAO hack: mixer-funded operator wallets, extended staging, and pre-obtained signatures executed in a rapid burst. Chainalysis CEO Jonathan Levin has similarly assessed it as likely TraderTraitor. Binance has not officially named a perpetrator; investigations continue. Funds from this incident have also been linked by investigators (e.g., ZachXBT) to the earlier Bitget exploit in some laundering paths.
On Ethereum, the attackers used EIP-7702 (an account delegation feature from the Pectra upgrade) to turn a Binance hot wallet (often referred to as “Binance 14”) into one controlled by a malicious “sweeper” smart contract. They submitted a batch of **50 pre-signed authorizations** for consecutive nonces so that at least one would match the live nonce amid ongoing activity. Once delegated, an operator (funded via Tornado Cash) could drain balances and later inflows. On the other nine chains, funds moved via ordinary signed transfers from hot wallets to attacker addresses. TRM assesses this indicates compromise of Binance’s hot-wallet **signing infrastructure** (valid signatures produced across chains with different key types/schemes in a short window), rather than pure private-key extraction.
Likely Initial Access / Attack Vector
Binance’s preliminary findings point to a **compromised DevOps engineer’s laptop**, which allowed access to a service container that could submit unauthorized withdrawal/signing requests. Co-CEO Richard Teng has stated it was not a simple single “one-click” action using one engineer’s permissions and involved a more complex process; no individual has been attributed responsibility. Binance reports **no evidence of any wallet private key leak**. This aligns with third-party assessments of “key misuse” or signing-infrastructure compromise (similar in high-level pattern to the Bybit incident, which involved a compromised developer machine and manipulated signing). Exact entry onto the laptop (phishing, supply-chain, or other) has not been detailed publicly.