In September, a Binance engineer got a message through a real job site from a company he’s never heard of.
The job site was real, so it doesn’t trigger any scam alerts.
The recruiter was friendly, and over the next few weeks, they swapped photos and videos. It’s exactly the kind of process you would expect when someone’s keen to hire you.
As this is an engineering position, there was a technical test. Download this program, have a crack at it, and send it back.
By this stage, anyone would have done the test.
Only one problem.
The test carried malware that gave the attackers access to Binance’s systems.
Shortly thereafter, they used that access, along with an internal AI tool, to take over software that two other Binance engineers relied on.
Nine days later, about $6.36 billion left Binance wallets on 10 blockchains, in roughly 20 minutes.
It’s the biggest crypto theft on record.
Heck, it’s the biggest single theft on record.
And the FBI has a pretty good idea that the attackers came from North Korea. It’s sort of their “thing” now: attack crypto exchanges, drain billions, buy missiles.
Not a bad business model, really…
Binance had US$6 billion to spare
The haul included 18,270 bitcoin.
Tether and Circle froze about $3 billion of their stolen stablecoins.
|
But about a billion or so was used as collateral to draw out liquid ETH from Aave.
That’s a really dire situation for anyone with crypto there one day and then none the next. At least Binance said it would cover the losses in full.
It has now replaced 98% of what was stolen from its own emergency fund, insurance fund, bitcoin reserve, and treasury.
When withdrawals reopened on Sunday, Binance was quick to let the world know how they were going.
Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.
But the problem is that this attack occurred at all.
In fact, it was so big that, all things considered, a $6 billion crypto exchange hack is big enough to call a “black swan” event.
Now, the good news is that while crypto markets did immediately react to this, fortunately, the Binance attack didn’t crash the market to zero.
The more I look at it, the more I think Bitcoin and crypto held up pretty well.
Sure, Bitcoin fell about 6% across the weekend, and it wiped out around $1.58 billion of leveraged bets.
But as I write, it’s back around $78,500.
Previous exchange failures and attacks such as those from Celsius and FTX to BlockFi and Bybit, led to market falls of 15% to 39%. Given the size and scale of this attack, it wouldn’t have surprised me to see similar numbers.
Instead, we’re still only down by single digits.
That’s one heck of a resilient market.
Britain’s Investment Letter Since 1938
In 1938, The Fleet Street Letter warned its readers that war was coming to Europe — and even identified September as the critical month.
Since then, its readers have been warned ahead of Black Monday, the dotcom crash and the 2008 financial crisis.
Today, Britain’s longest-running investment advisory is still looking for the “news behind the news” — and the investment opportunities others could be missing.
Click here to discover what The Fleet Street Letter sees coming next.
Capital at risk.
What Does Britain’s Oldest Investment Letter See Coming Next?
It warned readers ahead of Black Monday.
The dotcom crash.
And the 2008 financial crisis.
Now, nearly 90 years after it was founded, The Fleet Street Letter is still searching for the “news behind the news” — and the investment opportunities that could emerge from the next major turning point.
Click here to discover what its editors are seeing now.
Capital at risk.
No exchange is too big
What this does, again, is remind us of the phrase, “not your keys, not your crypto.”
If you don’t control the keys to your wallets, do you ever really control your digital assets?
(To be clear, the answer is no.)
Yes, while it was the biggest heist in history, and Binance covered its customers’ losses within days, the problem is that the world’s biggest exchange failed.
It’s also not the first time for Binance.
Binance lost 7,000 bitcoin from a hot wallet, one connected to the internet, in May 2019.
There are three certainties in life: death, taxes, and crypto exchange hacks.
And while it’s a reminder about the perils of centralised exchanges, it’s also a reminder about general personal security.
This attack wasn’t a flaw in their codebase. It was a trap, set in real life through an engineer who wanted a new job and was socially manipulated over time to gain access.
The effort put in was clearly rewarded by the amount drained.
Of course, we’re well aware that self-custody has its risks, too. Binance’s founder, CZ, even said nothing is 100% safe. He’s right.
But we’re still of the view that, for the protection of your own digital assets, self-custody using a multi-signature wallet like Bitkey from Block is the way to go.
And the only thing you should use exchanges for is to on-ramp and off-ramp your crypto assets.
Remember: not your keys, not your crypto.
Until next time,
Sam Volkering
Investment Director, Southbank Investment Research
PS If there’s one thing this Binance attack proves, it’s that even the biggest players can be blindsided by risks they never saw coming. And while no investing system can predict every black swan event, having the right tools to navigate an unpredictable market can make a real difference. That’s why I recently sat down with the man dubbed the “Godfather of AI investing”, a former MIT scientist who’s spent decades developing an AI-powered stock-picking system. He revealed the number one stock his system is flagging right now, plus one move he believes investors should consider before 9 November. You can watch our full interview, completely free, right here.
