11:12
So, Bitcoin is falling because we just witnessed the biggest heist in the history of cryptocurrency. I decided to release this emergency video because the problem is not just about Binance. This is happening with hardware wallet supply chains across the industry. Coins such as Ethereum, Bitcoin, Tron, and dozens of other tokens were stolen from Binance. By the time anyone could react, billions were gone, and Binance now says the total loss is around $6.3 billion. A security incident affecting billions of dollars in funds has hit the world's largest crypto exchange Binance, causing an emergency freeze of assets and a sharp drop in the prices of digital tokens.
Overall, this is very bad for the crypto industry. As a result, Binance, of course, froze all withdrawals while the investigation continued. There are a lot of questions from customers who say their life savings are on these exchanges, and Tether and Circle have also frozen about $3 billion in stolen money, which is good news. But it also leaves many questions: is our money safe on these exchanges at all and was this an internal matter? There are even rumors that it could have been the work of a certain state, like North Korea, or perhaps it's the work of some agent-like AI, and that this is just the beginning. This threatens many other exchanges as well. So, there's a lot to unpack,
so in this video I want to tell you what exactly we know happened and how you can better protect yourself in the future, because in this new age of technology, I believe that anything that can be broken will probably be broken sooner or later. So with that said, let's get down to business. Hello, my name is Andriy Dzhik. I hope you are well. Come for the finances and stay for the annual reminder to never keep your cryptocurrency on exchanges. The reason I wanted to make this video, besides explaining what's going on, is to hopefully help you understand how to think about security in the future.
The first thing we need to understand is how an exchange like Binance actually stores our money. You see, exchanges keep most of their cryptocurrency in what is called a cold wallet. Think of it like a bank vault. It is offline and very difficult to penetrate. But since it's an exchange, they also need money on hand to process withdrawals for everyone. And it should work instantly. Therefore, they keep some of their funds in a so-called hot wallet. A hot wallet is more like a cash register. It is connected to the internet, and money is constantly coming in and out of it. In this case, the wallet that was attacked was called Binance 14.
Apparently, it is one of the busiest Binance wallets, as it processed around 31 million transactions. And now about how exactly the robbery took place, according to what we know at this point. The day before this event, a brand new wallet was funded through a service called Tornado Cash. Tornado Cash is a so-called mixer. A mixer is a place where you deposit cryptocurrency, and it comes out with no trace of where it came from. It's like taking a deck of cards, shuffling it in every possible way, and losing the right card. This is essentially the crypto equivalent of paying with cash, which cannot be traced.
Typically, no legitimate exchange funds its wallets this way. So, that was kind of the first "red flag." In addition, for the same wallet, a tool was created designed to empty the wallet of everything it contains in one go. So think of it as a kind of job. In fact, after creation, the attacker conducted a test run using this technique. They created a few of their own wallets, practiced, and it really worked. Now, there will be some technical details, but here's how it works. Every time Binance 14, the same wallet, sends money, it gets a ticket number, similar to how they say, "Number 47 is being served" when you're in line, right?
He is constantly serving new customers. Therefore, this number is constantly changing. Ethereum, being programmable money, has a feature that allows a wallet to hand over its control to a program, like a permission saying, "Let this robot run my cash register." This permit only works if two requirements are met. It must be signed by Binance and printed with the exact ticket number being serviced at that specific point in time. The attacker somehow managed to obtain Binance's signature on these permission documents. But since they couldn't know in advance what number would fall out, they prepared 50 different papers, each with its own number.
49 of them were rejected, but one matched. And with that one coincidence, the robot gained access to the cash register. Here's how they managed to clean Binance 14 and withdraw about 167,000 Ethereum, which is equal to about $1.6 billion in Tether and 61 other tokens, all in just one transaction that was worth about $2.5 billion in total. For a small price, by the way, only 93 cents. Within moments, the internet began to notice that something was wrong. An on-chain analyst noticed this and wrote a post about it. But the attacker was already moving the coins.
You see, at that point they had already transferred about 195,000 Ethereum to a brand new wallet. Then another Binance wallet sent $780 million in USDC to the attacker again. Within an hour, Tether blocked the stolen USDT, Circle blocked USDC, and about $2.4 billion was frozen. That's when CZ wrote that it looked like a hack, but users' funds were safe. Binance then issued a statement investigating the potential security issue, still not confirming the hack, but the attack didn't stop there. In fact, the attacker did something very interesting that allowed them to continue
stealing while the situation developed. You see, when the robot emptied the wallet, it didn't take everything. He left exactly one ETH, which was enough for the wallet to operate so that when new funds arrived, it would be instantly emptied. As it remained open, Binance's automated systems continued to do what they always did: collect customer deposits and replenish the hot wallet. Here is the technical version of what happened in a nutshell. Now the obvious question: wait. How exactly did the attacker manage to get Binance to sign these orders, and was it perhaps an internal matter? So governments everywhere are paying more to
borrow, but so are you. And unlike the government, you can't print the difference. The rate you get on a mortgage, car, or anything else depends on your credit score, which brings me to the sponsor of today's video-Kickoff. When my parents moved us to the US, I didn't know anyone, I didn't speak English, and we had no credit history-it's the same trap that no one talks about: you need credit to get credit. Kickoff is a credit history building tool designed specifically for this problem. There is no credit check required to sign up, there are no interest or hidden fees, and you can sign up in minutes. You choose one of their monthly plans, with prices
starting at just $5 per month. You make payments on time, which is easy with autopay, and Kickoff reports those on-time payments to all three credit bureaus. It is designed around two key factors of your credit: payment history and limit utilization . And to be clear, this is a line that exists only to build credit history, not to spend money elsewhere. Kickoff users with credit scores below 600 who made their payments on time improved their scores by an average of 25 points in just the first month and up to 86 points after the first year. It's the number one credit building app in the App Store, and a better credit score usually means you pay less interest, and that money stays in your pocket instead of in the bank. So, if
your credit score is holding you back, Kickoff is giving my audience an 80% discount on their first month, which is just $1. Follow the link in the description or go to getkickoff.com/andre. Thanks to Kickoff for sponsoring this segment , and now back to the topic. So, here's how the attacker managed to get the signatures on these "receipts." At first it seemed like there were only three ways this could happen. The first way is that someone has stolen the Binance private key, which is essentially the master password to their wallet. Perhaps.
The second way is that someone tricked the Binance system into signing something they should n't have signed. Or a third way: it was an inside job, and someone helped the attacker. But how it actually happened, according to Binance's initial investigation that they just released, is that a DevOps engineer's laptop was hacked. This is essentially one of the people who maintain Binance's internal systems. And from his laptop, the attacker accessed one of Binance's internal services, and then used it to send unauthorized withdrawal transactions So, the attacker didn't actually steal the vault keys, they just got into the system that was using those keys, which I think is the explanation for those 50 "receipts," because if they had the
Binance master key, they wouldn't have had to waste all those 50 attempts. You would just look at the number provided, sign the perfect receipt and that would be it. But if you get into the Binance system and have it sign things for you, then you have to prepare them in advance and hope that some of them work. And because this all happens on the public blockchain, every single one of those 50 receipts is available for viewing right now, so 49 of them are marked as invalid, and only one is marked as successful. And that was all that was needed. This also explains why around 18,000 Bitcoins and hundreds of millions of dollars on the Tron network also left Binance wallets during the same period, because the "receipts" trick I just described
doesn't work with Bitcoin or Tron. But once they got into the system that approved withdrawals, they were n't limited to just one cashier. They could do this for many blockchains So, Binance still hasn't told us exactly how that laptop was compromised. And this is where the rumors about North Korea come in. Because hacking an employee's computer through malware, a phishing link, or even a fake interview-that's exactly what North Korea has done before. This is almost the same thing that happened to Bybit last year. The hackers also did not steal Bybit keys. They compromised a developer's machine at a wallet development company that Bybit was using, so when their team signed what looked like a
normal wire transfer, they actually gave away $1.5 billion. In fact, the FBI attributed this attack to North Korea. Ironically, just 2 days before this attack, Binance announced that its security team had blocked several cyberattacks linked to North Korea. At this point, this is all just speculation, as no one has officially claimed responsibility, but I think that in any case, it raises a much more serious question. One engineer, compromised or not, should not be able to put $6 billion at risk. How could one laptop cause so much damage?
Binance says it will release a full technical report once the investigation is complete, but in any case, all of this brings me to the most important question of this video: is our money safe in crypto at all? So the good news is that if you have money on Binance right now, you're likely safe because while over $6 billion left Binance wallets, about $3 billion of that was already frozen, mostly thanks to Tether and Circle, and the founder of DeFi Llama, which is tracking all of this, estimates that the real loss is likely to be closer to a billion dollars, which CZ actually reposted and said that the losses could be a little higher, but they will be fully covered, which is great news.
By the way, to better visualize a billion dollars: Binance holds approximately $144 billion in customer assets. So even a billion dollar loss for them is much less than 1%, which is unpleasant, but it won't ruin them. In fact, Binance also has an emergency fund for such events. It's called SAFU, which stands for Secure Asset Fund for Users, and they already used it in 2019 when hackers stole about 7,000 Bitcoins and Binance fully covered the losses. Today, this fund holds approximately 15,000 bitcoins, which is about $1.2 billion. So, on paper, it's about the same size as this damage. However, there are a few nuances you should be aware of.
Part of this fund is reportedly being held as required capital for regulators in Abu Dhabi. So not all of this can be free to use, and Binance's promise to replenish the fund only applies if the price of Bitcoin drops, not if they had to cover the consequences of a hacker attack. Realistically, if Binance covers this, and I think they will, the money will likely come from their own pockets, not just an emergency fund, but either way, users' funds should be safe. Meanwhile, Binance has suspended withdrawals on several networks as a precautionary measure while the investigation continues, which is understandable, but if you're trying to withdraw your money right now and can't, it's scary. And that brings me to the main purpose of
this video. When you hold cryptocurrency on an exchange, you don't actually own that cryptocurrency. Remember, you only own the promissory note. You have a promise from the exchange that they will refund your funds when you ask. Fortunately, Binance is large enough to cover losses, but a smaller exchange may not be able to do so. I say this because I myself lost over 10 bitcoins on a smaller exchange that went bankrupt, so it was a lesson for me -never keep money on an exchange , no matter how tempting it is with interest. There 's another element to this story that I think people are a little overlooking Everyone is celebrating the fact that Tether and Circle froze $2.4 billion in less than an hour. And in this
particular case, that's a good thing, isn't it But it also means that the companies behind these stablecoins can freeze billions of dollars almost instantly whenever they want. Fortunately, this power has now been used against the thief. But the same button works against everyone. And this is what you should beware of. So, the question arises, how to actually protect yourself? This is crazy, but about a year ago I released a video where I said I thought they were coming for our bitcoins. I think the goal is to centralize as much Bitcoin as possible in the hands of central planners and transfer our money into their securities. They would like us to
buy ETF versions of Bitcoin so they can hold them and promise us protection. I also said that we will likely see more and more attacks, and they will give us more incentives to keep their products. And while they encourage us to transfer money into their ecosystems, they themselves want to store their coins in their own wallets. And we see all this happening against a backdrop of fear, uncertainty, and doubt. So the question is, how do you actually protect yourself? This is how I do it. If you have a significant amount of cryptocurrency, the only thing I really trust is what's called a multi-signature wallet.
I won't go into technical details now. If you're interested, I'm sure I 'll make an explanation video for premium subscribers soon, but other than that, if you're not actively trading, your money shouldn't be on the exchange. Transfer them to a wallet that you have the keys to, such as a hardware wallet. Unfortunately, even that is risky today. There was an incident with a wallet called Coldcard Q. There are also reports of Ledger wallets being wiped out due to supply chain attacks. There is so much money in cryptocurrency now that we are seeing extremely sophisticated attacks on our funds.
So, if you are buying a hardware wallet, please buy it directly from the manufacturer. Never buy a used wallet, obviously, but also don't buy from random sellers or on Amazon or eBay. And if you do keep money on exchanges, and I know many do, and I understand that this is necessary for trading, please keep only what you actively use and distribute the funds. Don't keep everything on one exchange, no matter how big it is. Also, enable all the security features they offer, including two-factor authentication via app or physical security key, but not via SMS, please. And at the same time, you can add withdrawal addresses to a whitelist so that your cryptocurrency
can only be sent to addresses that you have approved. This is just my personal opinion, but I also don't trust DeFi or decentralized exchanges because they are safe until they stop being so, and then we see headlines like: "AI hacked the site and somehow withdrew all the funds." So, in the meantime, please be very careful in the coming days, because scammers love these kinds of events. After every major hack, there is a wave of fake support messages and fake compensation forms. Always remember: no legitimate service will ever write to you first to "help" you get your money back. Also, never copy a wallet address from your transaction history, as scammers actively send fake tokens from similar addresses, hoping you will
copy the wrong one by mistake. And lastly: understand what exactly you are holding. Stablecoins, such as USDT and USDC, are also debt instruments. And, as we just saw, they can also be frozen. In this case, they protected Binance, but it's worth knowing that the same feature applies to everyone. Of course, in fairness, self-storage is not risk-free either. If you lose your recovery phrase, no one can help you get it back. Therefore, please make backups on titanium or steel plates, and also add a 25th word to your passphrase for additional protection. I'm sure I'll make a video about this in the future in the premium section, but if you're interested, it's all down below. There I share additional
thoughts and post videos a day early. This allows me to take on fewer sponsors and create more videos like this. If this is helpful to you, the link is below. Thank you very much for watching. I'd be happy to see you here next week. Take care of yourself, and see you soon. See you later.
