YT YouTube2Text

YouTube2Text → Transcripts → How Binance Lost $6,300,000,000 in One Night

How Binance Lost $6,300,000,000 in One Night — Transcript

by Gloam · 2,429 words · 406 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00On Thursday afternoon, someone paid 93
0:02cents to send one transaction to the
0:04biggest crypto exchange in the world. 3
0:07minutes and 24 seconds later,
0:09>> [music]
0:09>> Binance's main Ethereum wallet was
0:12empty. By the end of the night, about
0:146.3 billion dollars was gone. The
0:17largest crypto theft ever recorded.
0:20Roughly four times the old record. No
0:22gun, no tunnel, nobody walked into a
0:25building. Binance's first explanation
0:28was a single laptop. But the next
0:30morning, even Binance was saying that
0:32wasn't the whole story. This is how
0:34[music] it happened, minute by minute.
0:36Who the investigators think did it, and
0:39why almost half the money was stopped
0:41within hours, while the rest may never
0:43come back.
0:46To see how this was possible, [music]
0:47you need one idea about how an exchange
0:49keeps money. Binance is the biggest
0:51[music] crypto exchange on the planet.
0:54It says it has 335
0:56million registered users [music] and
0:58around 160 billion dollars of their
1:00crypto in its care. Exchanges are
1:02supposed to keep most [music] of that in
1:04cold wallets. Keys kept offline. Slow to
1:07move, [music] very hard to steal. But
1:09people withdraw all day. So, an exchange
1:12keeps a smaller amount [music] in hot
1:14wallets. Always online, ready to pay out
1:16in seconds. A hot wallet is meant to be
1:19the [music] cash register, not the
1:20vault. Remember that. On Thursday, one
1:23of Binance's cash [music] registers was
1:25holding billions. Binance has been
1:27robbed before. In 2019, hackers took
1:30[music] 7,000 Bitcoin, about 40 million
1:33dollars. This was about 150 [music]
1:35times bigger. It also has a past.
1:38Founded in 2017 by Changpeng Zhao, known
1:41as [music] CZ, and Yi He. No official
1:44headquarters. In 2023, Binance [music]
1:47pleaded guilty to breaking US anti-money
1:49laundering law and paid 4.3 billion
1:52dollars. CZ served four months [music]
1:54in prison. A year ago this month,
1:56President Trump pardoned him. CZ doesn't
1:59run Binance anymore, but on Thursday,
2:02he'd be the first big name to say the
2:03word out loud.
2:05>> [music]
2:05>> The attack didn't start on Thursday. On
2:07Tuesday, October 27th, Binance said it
2:10had blocked several attacks that week
2:12[music] linked to North Korea. Fake job
2:14interviews, coding tests. No money lost,
2:17it said. Nobody has shown any link to
2:20what came next. Wednesday, a brand new
2:22wallet receives about a tenth of one
2:24ether through Tornado Cash, a service
2:27built to hide where money comes from.
2:29That wallet becomes the attacker's
2:30remote control. Wednesday into Thursday,
2:33according to TRM Labs and the security
2:35firm Blockaid, the attacker puts a small
2:38program on the Ethereum blockchain, a
2:40sweeper built to empty a wallet in one
2:43move. It only takes orders from that
2:45remote control wallet. They test it on
2:48two wallets, then a full rehearsal on a
2:51third. Each run costs a few dollars.
2:54Then, TRM says, they wait. About 4
2:57hours.
2:58Why the wait? Investigators haven't
3:00said,
3:01>> [music]
3:01>> but what came next hit about 10
3:03blockchains in a single evening. 5:05 in
3:06the afternoon, New [music] York time.
3:08Five Binance wallets on the XRP ledger
3:11start sending. In 4 minutes, about $300
3:14million in XRP [music] goes to one
3:16address. Minutes later, Binance wallets
3:19on Solana and Optimism are drained.
3:214:20, Binance's Bitcoin [music] hot
3:24wallet sends 18,270
3:27Bitcoin, about 1 and a half billion
3:29dollars. [music]
3:30Within 2 minutes, Tron. $612 million in
3:34the stable coin USDT. None of this looks
3:37like a break-in. These are signed, valid
3:39withdrawals.
3:40>> [music]
3:41>> As far as each blockchain can tell,
3:43Binance is just paying someone. And in
3:45the same [music] minute as the Bitcoin
3:46transfer, something stranger happens on
3:48Ethereum. Since May 2025, Ethereum has
3:52had a feature called EIP-7702. [music]
3:55It lets an ordinary wallet sign a note
3:57that says, "From now on, this program
4:00runs my account." [music] It was built
4:01to make wallets easier to use. Picture
4:04the wallet as a vault.
4:05>> [music]
4:05>> That note hands the vault over to a
4:07robot that follows its own instructions.
4:10At 4:20 [music] and 59 seconds, a
4:12transaction reaches Binance's main
4:14Ethereum hot wallet labeled [music]
4:16Binance 14. Inside are 50 of those
4:19notes, each pointing the wallet at the
4:21attacker's robot.
4:22>> [music]
4:22>> Why 50? Every transaction a wallet sends
4:25gets a number in order. Binance 14 was
4:28busy handling [music] withdrawals, so
4:30its number kept climbing. The attacker
4:32couldn't know which number it would be
4:34on, so they brought [music] a note for
4:35each of the next 50. One of them had to
4:38fit. One did. And every one of those
4:40notes carried a valid Binance signature.
4:42[music]
4:43Nobody has fully explained that yet. The
4:45fee for that transaction? About 93
4:48cents. 4:24 and 23 seconds. 3 minutes
4:52and 24 seconds after the handover, the
4:54robot [music] moves. One transaction,
4:57167,000
4:58Ether, 1.6 billion dollars in USDT, and
5:02dozens of other tokens. All of it out.
5:05Most of the money left Binance [music]
5:07in about 20 minutes. At 4:32, the
5:10earliest public alarm we could find
5:11[music] goes up on X. Unconfirmed, but
5:14possibly massive Binance hack. To be
5:17clear, Ethereum wasn't hacked. The
5:19attackers used a normal feature as their
5:21getaway car. And on the other chains,
5:24none of that.
5:24>> [music]
5:25>> Just ordinary signed withdrawals. Now
5:27the attacker has a problem. A big part
5:30of what they took is stable coins,
5:32>> [music]
5:32>> crypto dollars like USDT and USDC. The
5:35companies that issue them can freeze
5:37them. Bitcoin and Ether? No issuer can
5:40freeze those.
5:41>> [music]
5:41>> So, the race starts. According to TRM
5:44Labs, the attacker dumps stolen USDT for
5:47Ether, racing the freezes at a loss of
5:49more than 10%. Another 60 million goes
5:52into the lending app Aave to borrow
5:54Ether against it. 5:01 p.m. Tether
5:57freezes 971 million USDT
6:00in the attacker's main [music] wallet,
6:0237 minutes after the sweep, 5:04. Circle
6:06freezes 823 million in USDC working with
6:10law [music] enforcement. 5:15. CZ posts,
6:13"User funds are safe. It does look like
6:16a hack on Binance." 10 minutes later,
6:18Tether's CEO says more than 1 and 1/2
6:21billion USDT is frozen. Then, Ripple,
6:24World Liberty Financial, Aave freezes
6:27its markets. And just after 8:00,
6:29Arbitrum's Security Council steps in and
6:32forcibly moves about $30 million out of
6:34the attacker's [music] wallet. By
6:36morning, around $3 billion had been
6:38frozen by Binance's count. Sit with
6:41that. Crypto is meant to be
6:42decentralized, yet nearly half of what
6:45was stolen got frozen because a handful
6:47of companies pressed a freeze button.
6:49Now, the detail that matters most.
6:51Binance announced withdrawals were
6:53paused at 6:33 p.m. That should have
6:56ended it. It didn't.
6:57>> [music]
6:58>> The robot didn't need Binance's
6:59withdrawal system. It already controlled
7:02the wallet. As fresh money landed in
7:04Binance 14, the robot swept it out at
7:07least six more times after the main
7:08sweep, and two of those came after
7:10Binance's pause. At 7:05, a second wave
7:14hits Binance wallets on Avalanche and
7:16Polygon. No robot there, just more
7:18signed withdrawals. The last
7:20unauthorized Ethereum sweep lands at
7:227:56, 83 minutes after Binance said
7:26withdrawals had stopped. Why so long?
7:28Part of the answer, the security firm
7:30Blockaid says, is that changing a
7:32wallet's keys doesn't undo that kind of
7:34handover. The wallet has to sign a new
7:37note taking itself back. According to
7:39the data firm Bitquery, that happened at
7:4110:08. The robot had been in charge for
7:44almost 4 hours.
7:47At around 10:30 that night,
7:48>> [music]
7:49>> Binance gave its first explanation. The
7:51incident, it said, may involve a
7:53compromised DevOps engineer's laptop.
7:56From there, the attacker reached [music]
7:58a service container, an internal system
8:00that can submit withdrawals. And
8:03>> [music]
8:03>> Binance said it found no evidence any
8:05wallet's private key had leaked. That
8:08was the first account. One laptop,
8:10[music] $6 billion.
8:12By the early hours, Sky News was running
8:15the headline, "Largest bank heist in
8:17human history." But that leaves a lot
8:19unexplained. According to the security
8:22firm Blockaid, [music] 11 separate hot
8:24wallet keys signed transfers to the
8:26attacker. How does one internal service
8:28[music] do that on about 10 blockchains
8:31without anything stopping it? By Friday
8:33morning, Binance had widened the story
8:36[music] itself. It had found additional
8:38points of breach. Co-CEO Richard Teng
8:41>> [music]
8:41>> wrote that the attacker did not simply
8:43use one engineer's permissions, and this
8:45was not [music] a single one-click
8:47action. So what did the attackers
8:49actually get? The keys or the system
8:52that uses them? The experts [music]
8:53don't agree. Blockaid doesn't think a
8:56key was leaked, and Check Point told the
8:58BBC the attackers didn't [music] steal
9:00the private keys. But former Mount Gox
9:02chief Mark Karpeles told Reuters he
9:05thinks the attackers likely [music] got
9:06the keys to at least two Binance
9:08wallets. A Hong Kong lawyer, Joshua
9:10[music] Chu, put it simply, "The
9:13attacker may not have stolen the vault
9:15key. They may have hijacked the system
9:17that tells the vault to release money."
9:19>> [music]
9:19>> And one more question Binance hasn't
9:21answered, "Why could a single hot
9:23wallet, the cash register, give up about
9:26two and a half [music] billion dollars
9:27in one transaction?" Binance hasn't said
9:30who did this. Blockchain investigators
9:32already have a name. TRM Labs says with
9:35[music] high confidence it was Trader
9:37Traitor, a North Korean state hacking
9:39unit the FBI [music] links to the
9:41Lazarus Group. Chainalysis' CEO said it
9:44was likely the same group. A TRM
9:47investigator told the Wall Street
9:48Journal
9:49>> [music]
9:49>> this was absolutely North Korea. Their
9:52reasons are fingerprints from earlier
9:54heists, seed money through Tornado Cash,
9:57long quiet staging, [music]
9:59pre-signed approvals fired all at once.
10:02Then, the on-chain detective Zach
10:04[music] XBT found money from this hack
10:07at the same address as money stolen from
10:09Bitget, another exchange robbed 5 weeks
10:11earlier. And the [music] group's
10:13playbook is well documented. February
10:162025,
10:17Bybit loses 1 and 1/2 billion dollars
10:20after a developer's computer at a wallet
10:22company is hacked. The FBI blamed Trader
10:24[music] Traitor. In 2024, Japan's DMM
10:28Bitcoin, a fake recruiter sends a coding
10:31test [music] to an employee at a partner
10:33firm. About 300 million dollars
10:36>> [music]
10:36>> gone. The biggest crypto heists of the
10:38last few years didn't start with broken
10:40code. They started with a person. But
10:43the case isn't closed.
10:45>> [music]
10:45>> The analysis firm Elliptic still calls
10:47North Korea likely, not certain. The
10:50shared address holds only about 39,000
10:53dollars of Binance money, and one
10:55launderer can serve many clients. And
10:57this attacker has converted stablecoins
10:59[music] slowly and laundered differently
11:01from the Bybit pattern, which Elliptic
11:03says is unusual for North Korea. No
11:06government has confirmed anything.
11:07[music]
11:08North Korea hasn't responded, and it
11:10routinely denies these accusations. If
11:12it was North Korea, the scale is hard to
11:15take in. [music] Chainalysis says North
11:17Korea stole a record 2 billion dollars
11:19in crypto in all of 2025. [music]
11:22This one night was about three times
11:24that. More than every crypto thief on
11:27Earth stole all last year
11:29>> [music]
11:29>> combined. And by some estimates, around
11:3140% of North Korea's stolen crypto ends
11:34up funding weapons. So where is the
11:36money right now? The Bitcoin hasn't
11:39moved. All 18,270
11:42coins sit in 19 wallets. 17 of them hold
11:45exactly 1,000 Bitcoin each. Not one has
11:49moved since Thursday afternoon. No
11:51company can freeze those coins. As one
11:54wallet founder told Bloomberg, that
11:56Bitcoin is gone. It's in the [music]
11:57hacker's hands. The ether is moving. By
12:01Arkham's count, the attacker holds close
12:03to half a million ETH across [music]
12:05about 10 addresses. More than a billion
12:07dollars of it moved to new wallets
12:09overnight, according to the tracker
12:11Onchain Lens. Depending on who's
12:13counting, between 2.4 and 3.3 billion
12:16dollars is now out of any company's
12:19reach. Here's the twist. The coins that
12:21could be stopped mostly were. The coins
12:24built so nobody could ever stop them,
12:26those got away. The market felt [music]
12:28it. Bitcoin fell to a 6-week low of
12:31$76,368.
12:34BNB, Binance's own token, fell between 5
12:38and 10%. [music]
12:39About 1 and 1/2 billion dollars in
12:41leveraged bets were wiped out in a day.
12:43Crypto was already falling on a tech
12:45sell-off,
12:46>> [music]
12:46>> so not all of that is the hack. Binance
12:49says users won't lose a cent.
12:50>> [music]
12:51>> It says it has set aside more than 6.3
12:53billion dollars of its own money to
12:55cover the losses, on top of what's
12:57frozen. Its [music] emergency fund,
12:59SAFU,
13:01holds about 1 billion. And, according to
13:03the trade publication [music] Insurance
13:05Business, it has no conventional
13:07insurance policy. So, this is [music]
13:10Binance paying from its own pocket. The
13:12fact that it can even promise that tells
13:14you how big Binance is. Withdrawals are
13:17still paused as we record this. Binance
13:20says they should start reopening around
13:22November 1st. Its next proof of
13:24reserves, reportedly [music] due the
13:26same day, should show whether the stolen
13:28coins have really been replaced. [music]
13:30One warning. Security firms say scammers
13:33are targeting worried Binance users with
13:35fake fund recovery pages. [music] Never
13:38share your seed phrase or keys with
13:40anyone claiming to be Binance support.
13:42Nobody legitimate will ask. Some people
13:45online are already saying AI did [music]
13:48this. There's no evidence of that.
13:50Binance hasn't said it. The
13:51investigators haven't said it. Every
13:54step on record is an old technique. What
13:57is on record? Google's researchers have
13:59caught a different North Korean unit
14:01[music] using AI to write phishing
14:02messages and what appears to be a deep
14:05fake of a crypto CEO on a fake video
14:07call. And Blockaid says its own AI
14:10system flagged the drain less than 2
14:12[music] minutes after the main sweep
14:13before any public report. So, there's no
14:16sign AI was the weapon here. It's the
14:19backdrop. [music]
14:20The real lesson is older. A wallet that
14:22should have held pocket money held
14:24billions. And by Binance's own account,
14:27near the start of it was one person's
14:29computer.
14:29>> [music]
14:30>> Binance has promised a full technical
14:32postmortem. It should tell us how that
14:34laptop was compromised [music] and
14:36whether Tuesday's fake interview
14:37attempts had anything to do with it.
14:39Meanwhile, [music] 19 Bitcoin wallets
14:41are sitting perfectly still. 93 cents to
14:44open the door. Almost 4 hours to close
14:47it. When those wallets move, we'll be
14:49watching. Subscribe so you don't miss
14:52what happens next.

About this transcript

This page contains the full transcript of How Binance Lost $6,300,000,000 in One Night by Gloam, generated from the public captions YouTube serves with the video. The transcript has 2,429 words across 406 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.