Attacker gets away with up to $3 billion from Binance

An attacker has stolen around $5.5 billion in cryptoassets from multiple hot wallets^a belonging to Binance, the world’s largest cryptocurrency exchange, and still controls around $3 billion of it after stablecoin issuers froze what they could. The total amount tracked by the Arkham blockchain intelligence firm sits at around $5.9 billion, though that’s inflated: it counts tokens that have been frozen by their centralized issuers, and it values various illiquid tokens at prices the attacker won’t actually get if they try to sell. These estimates are all very much in flux as various platforms work to freeze tokens or otherwise thwart the attacker from cashing out, and as wallets are either connected to the exploiter or found to be unrelated.

But unlike many supposedly “multi-billion dollar” crypto hacks, where the headline figure relies on the notional value of illiquid assets that could never be sold for anywhere near that amount, the majority of these stolen assets were major stablecoins, bitcoin, ethereum, and other fairly liquid tokens.

Around $5.5 billion in liquid assets were stolen; Tether has frozen at least $1.567 billion of the stolen $1.768 billion in USDT, and Circle has frozen around $800 million of the stolen $823 million. World Liberty Financial froze the $27 million in USD1 stolen by the attacker, and the Arbitrum ethereum layer-2 network froze an additional $30.5 million that had moved to its network. That leaves the attacker with somewhere between around $3 billion.

Binance founder Changpeng Zhao, who is legally not allowed to have any active role with the company [I98] yet still has remarkable amounts of inside knowledge into its inner workings, posted on Twitter less than an hour after the theft that “User funds are safe!”, adding early estimates of how much Tether and Circle had frozen. He added, “I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

He later tweeted “Loss might be a bit higher than [$1 billion], but will cover.” (Why a person who is barred from any control over Binance would be the one promising this is an exercise I will leave to the reader.)

Binance keeps an emergency insurance fund in case of exploits or other crypto disasters. Its most recent balance report puts it at around $1.3 billion.¹ Unless more is recovered, Binance will either fail to make users whole or dip into its own balance sheet — potentially to the tune of 10 figures.

The contagion also threatens to spread beyond Binance. Aave, a defi lending project, paused some of its markets to stop the attacker from depositing stolen assets as collateral and borrowing against them — a move that could otherwise leave it holding significant bad debt. Protocols that are slower to respond may not be so lucky.

The Binance theft came within hours of a separate, much smaller theft of around $2.7 million from Polymarket users [W3IGG], and some people wondered whether the two were connected. I doubt it. Polymarket has blamed its incident on a compromised third-party vendor, which an attacker apparently used to inject a malicious script into the site’s frontend and steal user funds. The Binance attacker got access to the exchange’s own hot wallets. They’re very different attacks, and nothing besides timing ties them together so far.

This article was updated on October 29 at 8:47pm to remove some skepticism around whether bitcoin attributed to the attacker was stolen, after a conversation with another researcher made me less confident the wallets were unrelated.