The Biggest Crypto Theft In History

0:00 So, Bitcoin is crashing because we just experienced the biggest heist in crypto's history. And I wanted to put this out as an emergency video because this is not just Binance. This is happening to supply chains of hardware wallets across the whole industry. Coins like Ethereum, Bitcoin, Tron, and dozens of different tokens were stolen from Binance. By the time anyone could react, billions were gone, and Binance now says the total impact is around $6.3 billion. A security incident impacting billions of dollars of funds has hit the world's largest crypto exchange, Binance, triggering emergency asset freezes and sharp losses in the price of digital tokens. This is overall very bad for the crypto industry. And as a result of this, of course, Binance has frozen all withdrawals pending investigation.

0:46 There's a lot of questions of customers who say their life savings are on these exchanges. and Tether and Circle have also frozen about $3 billion of the stolen money, which is good news. But that also leaves a lot of questions, like whether our money is safe on these exchanges at all, and was this possibly an inside job. There's even rumors that it could have been a nation state like North Korea, or maybe it was the work of some agentic AI, and that this is all just the beginning. This is coming to a lot of other exchanges as well. So, there's a lot to go through.

1:19 So, in this video, I want to walk you through exactly what we know happened and how you might want to protect yourself going forward because in this new age of technology, I think anything that can be hacked will probably be hacked at some point or another. So, with that said, let's get into it. Hi, my name is Andre Jick. Hope you're doing well. Come for the finance and stay for the yearly reminder to never keep your crypto on exchanges. So the reason I wanted to make this video besides explaining what's happening is to hopefully help you understand how to think about security in the future. So the first thing we need to understand is how an exchange like Binance actually holds our money. See, exchanges keep most of their crypto in what's called a cold storage wallet. Think of it like a bank vault. It's offline and it's very hard to break into. But because they're an exchange, they also need money on hand to process everyone's withdrawals.

2:19 And that needs to work instantly, which is also why they keep some of it in what's called a hot wallet. Now, a hot wallet is more like a cash register. It's connected to the internet, and money is going in and out of it constantly. In this instance, that wallet that was attacked was called Binance 14. Apparently, it's one of Binance's most busiest wallets because it's processed something like 31 million transactions. Now, here's how the heist actually happened. According to what we know so far, see, the day before this happened, a brand new wallet was funded through something called tornado cashache. Tornado cash is what's called a mixer. A mixer is where you put crypto in and it comes out the other side with no trail back to where it came from.

3:08 It's kind of like taking a deck of cards and then shuffling it in all sorts of crazy ways, thus losing the playing card. It's basically the crypto equivalent of paying in cash that's untraceable. Typically, no legitimate exchange funds its wallets in this way. So that was kind of like the first red flag. Now that same wallet also built a tool designed to empty a wallet of everything it holds in one sweep. So think of it as kind of like a robot. In fact, after they built it, the attacker did a test run using this technique. They set up a few wallets of their own and they practiced it and it actually worked.

3:54 Now, this is where it gets kind of technical, but here it goes. Every time Binance 14, that wallet, sends money out, it takes a ticket number, kind of like how it says now serving number 47 when you're at the DMV, right? It is constantly serving new customers. So, that number is always changing. Now, Ethereum, because it's programmable money, has a feature that lets a wallet give its control over to a program, like a permission slip that says, "Let this robot run my counter." Now, that slip only works if two things are true. It has to be signed by Binance and it has to be printed with the exact ticket number being served at that exact moment in time. Now, the attacker somehow managed to get Binance's signature on these permission slips, but because they couldn't know ahead of time which number would come up, they brought 50 different slips, all with different numbers. Now 49 of those got rejected but one of them was a match and with that one match the robot was running the cash register.

5:13 That's how they were able to sweep Binance 14 and take about 167,000 Ethereum worth about $1.6 6 billion in Tether and 61 other tokens all in just one transaction that was in total worth roughly $2.5 billion at the low low cost by the way of just $93. Now moments later the internet started to notice that something was off. An onchain analyst spotted this and he posted about it but the attacker was already moving the coins. See, by that point, they had already moved about $195,000 Ethereum to a brand new wallet.

5:54 Then another Binance wallet sent $780 million in USDC to the attacker again. Within the hour, Tether locked up the stolen USDT, Circle locked up the USDC, and about $2.4 billion was frozen. It was at that point when CZ posted that it looked like a hack and that user funds were safe. Binance then issued a statement saying it's investigating a potential security issue. Still not confirming a hack, but the hack did not stop there. In fact, the attacker did something very interesting and allowed them to continue stealing as this was developing. See, when the robot emptied the wallet, it didn't take everything.

6:44 It left exactly one ETH behind, which was just enough for the wallet to keep working. So that when new money was deposited, the wallet was instantly swept. Because it stayed open, Binance's automated systems kept doing what they always do, which is collecting customer deposits and refilling the hot wallet. So that is in a nutshell the technical version of what happened. Now the obvious question is hold on how exactly did the attacker get finance to sign those slips in the first place and was that possibly an inside job? So governments everywhere are paying more to borrow. But so are you. And unlike a government, you can't print the difference. The rate you get on a mortgage, a car, and pretty much everything comes down to your credit.

7:35 Which brings me to the sponsor of today's video, Kickoff. When my parents moved us to the US, I didn't know anyone. I didn't speak English, and we had zero credit history, and that's the catch 22 nobody talks about, which is that you need credit to get credit. Kickoff is a credit building tool designed for exactly that problem. There's no credit check to apply, no interest, and no hidden fees, and you can sign up in a few minutes. You pick one of their monthly plans, which start at just $5 a month. You make your payment on time, which is easy with autopay. and kickoff reports those on-time payments to all three credit bureaus. It's designed around two key factors in your credit, payment history and utilization. And to be clear, this is a line that exists only to build credit, not for spending money elsewhere. Kickoff users with credit under 600 who made on-time payments increase their credit by an average of 25 points in just their first month and up to 86 points after their first year.

8:24 And it's the number one credit building app on the app store. And better credit generally means you pay less interest. And that's money that stays in your pocket instead of the banks. So if your credit is holding you back, Kickoff is giving my audience 80% off your first month, which works out as low as $1. Click the link in the description or go to getkickoff.com/andre. Thank you to Kickoff for sponsoring this segment. And now let's get back to it.

8:45 So here's how the attacker was able to get those slips signed. Now going into this, at first there were only three ways it could have happened. The first way is that someone stole Binance's private key, which is basically the master password to their wallet. Possible. The second way is that someone tricked Binance's system into signing something that they shouldn't have. Or the third way, it was an inside job and someone helped the attacker. But how this actually happened, according to Binance's initial investigation that they just released, is that a DevOps engineer's laptop was compromised. And this is basically one of the people who maintains Binance's internal systems and from his laptop, the attacker got into one of Binance's internal services and then used it to submit unauthorized withdrawal transactions. So, the attacker never really stole the keys to the vault. They just got inside the system that used the keys, which I think is exactly what those 50 permission slips were all about. Because if they had Binance's master key, they would not need to use up all those 50 guesses. You would just look at the number being served, you would sign the perfect slip, and then you'd be done. But if you get inside Binance's system, getting it to sign things for you, then you'd have to grab them ahead of time, then hope one of them works. And because all of this happens on a public blockchain, every one of those 50 slips is just sitting there for us to look at right now, which is why 49 of them are marked invalid and only one of them is marked success. And that is all it took. It also actually explains why around 18,000 Bitcoin and hundreds of millions of dollars on the Tron network also left Binance's wallets during this window, too. Because the permission slip trick I just explained, it does not work on Bitcoin or Tron. But once they were inside the system that approved the withdrawals, they were not limited to just one cash register. They could do it for multiple blockchains.

10:55 Now, what Binance has not told us yet is how that laptop got compromised in the first place. And that's where the North Korea rumors come in. Because compromising an employes's computer through malware or a fishing link or even a fake job interview is exactly what North Korea has done in the past. It is almost exactly what happened with Bybit last year. The hackers did not steal Bybit's keys either. They compromised a developer machine at the wallet software company that Bybit used so that when their team signed what looked like a normal transfer, they were actually giving up $1.5 billion. In fact, the FBI attributed that attack to North Korea. Ironically, just 2 days before this attack happened, Binance said its security team blocked several North Korea linked cyber attacks. Now, as of right now, this is all speculation because nobody's officially attributed this to anyone, but I think either way, this raises a much bigger question. A single engineer, compromised or not, should not be able to put $6 billion at risk. How is it that one laptop was able to do this much damage? Binance says it'll publish a full technical breakdown once the investigation is complete. But either way, all of this really brings me to the most important question in this video, which is, is our money even safe in crypto anymore? So, the good news about all of this is that if you have money on Binance right now, you're probably going to be okay? Because even though over $6 billion left Binance's wallets, about 3 billion of that was already frozen thanks mostly to Tether and Circle. And the founder of something called DeFi Llama, which tracks all of this, estimates that the real loss is probably going to be closer to about a billion, which CZ actually reposted and said the loss might be slightly higher, but that it will be fully covered, which is great news. By the way, to put a billion dollars in perspective, Binance holds roughly $144 billion in customer assets. So, even a billion dollar loss is way under 1% for them, which hurts, but it's not going to break them. In fact, Binance also has an emergency fund for events like this one. It's called Safu, which stands for secure asset fund for users. And they actually used it back in 2019 when hackers stole about 7,000 Bitcoin and Binance covered the whole thing. Today that fund holds roughly 15,000 Bitcoin, roughly about 1.2 billion. So on paper, about the same size as this loss. There's only a couple caveats though that you should know about. Part of that fund is reportedly being held as required capital for regulators in Abu Dhabi. So, not all of it might be free to use and Binance's promise to top the fund back up only applies if it drops because Bitcoin's price falls, not because they had to pay out a hack. So, realistically, if Binance does cover this, which I think they will, it's probably going to come out of their own pocket. Not just the emergency fund, but either way, user funds should be safe. Now, in the meantime, Binance has paused withdrawals on several networks as a precaution while they investigate, which is totally understandable. But if you're someone who's trying to get your money out right now and you can't, that is scary. And that brings me to the point of this whole video. When you keep crypto on an exchange, you don't actually own that crypto. Remember, you own an IOU. You own a promise from that exchange that they will give it back when you ask.

14:46 Now, thankfully, Binance is big enough to cover the loss, but a smaller exchange might not be able to. And I say this because I've lost over 10 Bitcoin on a smaller exchange that went bankrupt. So, that was my learning lesson to never keep money on an exchange, no matter how much they entice you with interest. Now, there's also one more element to this story that I think people are kind of missing. Everyone is celebrating the fact that Tether and Circle froze $2.4 4 billion in under an hour. And in this case, that's a good thing, right? But what that also means is that those companies behind these stable coins can also freeze billions of dollars almost instantly whenever they decide to. Now, luckily for now, that power was used against a thief. But that same button works on everyone, and that's something you have to be careful of. So, the question is, how do you actually protect yourself? It's crazy because about a year ago, I made a video where I said, I thought they would be coming for our Bitcoin. I think the goal is to centralize as much of it as possible into the hands of the central planners and put our money into their securities instead. They would love us to buy the ETF versions of Bitcoin so they can hold it and promise us protection. I also said that we'd most likely see more and more attacks and they would give us more incentives to hold their products. And while they incentivize us to move our money into their ecosystems, they would want to self-custody their coins for themselves.

16:18 And we're seeing all of this play out with fear, uncertainty, and doubt in the meantime. So the question is, how do you actually protect yourself? And here's how I do it. If you have a sizable amount of crypto at this point, the only thing I really trust is what's called a multi-IG solution wallet. Now, I'm not going to go into the technical details here. If you're interested, I'm sure I'll have a video of that explaining it soon in the premium member section. But other than that, if you're actively trading something, your money does not need to be on an exchange. Move it to a wallet where you hold the keys, like a hardware wallet. Now, unfortunately nowadays, even that is risky. There was an incident with a wallet called Cold Card Q. There are also reports of ledger wallets being drained because of supply chain attacks. There is now so much money in crypto. We are seeing extremely sophisticated attacks on our money. So if you do buy a hardware wallet, please buy it directly from the manufacturer.

17:22 Never buy a used wallet obviously, but never buy from a random seller or an Amazon or eBay. And if you do keep money on exchanges, and I know a lot of people do and I understand that for trading, please only keep what you're actively using and spread it out. Don't put everything on one exchange, no matter how big that exchange is. And also turn on every security feature that they offer, including two factor authentication with an authenticator app or a physical security key, not text messages, please. And while you're at it, you can also withdraw whitelist addresses so your crypto can only be sent to the addresses that you've approved. Now, this is just me personally, but I also do not trust DeFi or decentralized exchanges because they're safe until they're not. And then we get some headlines saying AI broke the website and drained all the wallets somehow. So, in the meantime, please be very careful in the next few days because scammers love these kinds of events. After every major hack, there is an influx of fake support messages and fake compensation forms. Always remember, no one legitimate will ever message you to help you recover your money. And also, never copy a wallet address from your transaction history because scammers are actively sending fake tokens from lookalike addresses, hoping that you'll copy the wrong one by mistake. And lastly, also understand what you're holding. Stable coins like USDT and USDC are also IUS and as we just saw they can be frozen too. Now in this case they protected Binance but it's worth knowing that this same feature applies to everyone. Now to be fair self-custody is not risk-free either. If you lose your recovery phrase no one can help you get it back. So, please make backups on things like those titanium plates and steel plates and also add those 25thword passphrases to make it extra secure. I'm sure I will make videos about this in the future in the premium members section. But if you're interested, all of that will be down there. I post my extra thoughts and I also post a day early. It allows me to take on fewer sponsors and make more videos like this. If that's useful to you, the link is down below. Thank you so much for watching. I'd love to see you back here next week. Stay safe and I'll see you soon.