How North Korea Stole $6.3 Billion From Binance in 20 Minutes
How North Korea Stole $6.3 Billion From Binance in 20 Minutes
1 hour ago•Unchained•Laura Shin
Podcast1 hr 20 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

The discussion offers no clear buy recommendation or price target for BTC, ETH, AAVE, or the other named tokens, so avoid treating laundering flows as bullish signals. Reduce custody risk by avoiding reliance on a single exchange and reviewing security and withdrawal controls before holding crypto on a platform. Treat USDT and USDC as issuer-controlled assets: freezes can help recover stolen funds but may also restrict access. Be especially cautious with THORChain and DeFi lending, given the episode’s concerns about illicit flows, emergency market freezes, and regulatory exposure.

Detailed Analysis

Binance (crypto exchange)

Context

  • The discussion described a reported $6.3–$6.4 billion theft from Binance hot-wallet infrastructure across multiple blockchains. The speakers said the attackers appeared to exploit internal transaction-signing systems; they noted that no private-key leak had been confirmed.
  • About $3 billion was reportedly frozen by companies and protocols, but billions remained at risk of being laundered.
  • The guests emphasized operational-security risks, including compromised developer devices and attackers potentially moving through an organization for weeks or months before stealing funds. Other exchanges, including Bybit, WazirX and Bitget, were cited in connection with previous large hacks.

Takeaways

  • Treat exchange custody and security as material risks when choosing where to hold crypto. The episode offered no endorsement of Binance or other exchanges.
  • The speakers’ practical security message for organizations was to use managed devices and endpoint detection and response tools, and to limit access and permissions. For individual investors, the discussion reinforces the risk of relying on any single platform.

Bitcoin (BTC)

Context

  • Bitcoin was named among the assets affected by the incident and as a possible destination for stolen funds.
  • The guests speculated that North Korean hackers may favor Bitcoin and Ether more readily because stablecoins can be frozen by their issuers. They did not present this as a change in the hackers’ overall behavior.

Takeaways

  • The discussion provides no price target or bullish investment case for BTC. It highlights a distinction between assets that can be frozen by an issuer and assets that generally cannot be frozen in the same way.
  • Do not interpret possible laundering flows into Bitcoin as evidence of investor demand or positive fundamentals.

Ethereum (ETH)

Context

  • ETH was involved in the theft and subsequent laundering activity. The speakers said the attackers used EIP-7702 to help move funds faster, but stressed that the feature was not the original vulnerability: the core issue was compromised operational infrastructure and unauthorized transaction signing.
  • The episode said some stolen funds were swapped into ETH. It also described an instance in which attackers used about $60 million in funds to borrow nearly 20,000 ETH through Aave.
  • One guest said North Korea held more ETH than the Ethereum Foundation at the time of the discussion. The guests also noted that large swaps through low-liquidity venues could lead to substantial losses.

Takeaways

  • The episode does not establish a bullish or bearish ETH price outlook. It does highlight security, liquidity and DeFi-contagion risks around large movements of ETH.
  • The speakers cautioned that new wallet features can expand the attack surface, even when they are not the cause of a particular breach.

USDT and USDC

Context

  • The stablecoin issuers Tether and Circle helped freeze stolen funds. The guests said the response was unusually fast and noted that the companies had strong business incentives to protect their interests.
  • They also described attackers moving some USDT through market makers and using it as collateral to borrow ETH. The episode’s discussion of freezing Aave markets illustrates how activity involving stolen funds can affect other users and protocols.

Takeaways

  • USDT and USDC carry issuer-intervention risk: the same ability to freeze funds can help recover stolen assets, but also means balances are not as resistant to intervention as decentralized assets.
  • Consider both the benefits and limits of stablecoin recoverability, and the possibility that emergency responses can disrupt access to DeFi services.

Aave (AAVE)

Context

  • Aave was discussed as a venue where attackers borrowed nearly 20,000 ETH against USDT connected to the laundering activity.
  • The episode said Aave froze markets across networks to limit further avenues for the attacker. The guests noted that such actions can disrupt normal protocol use and raised broader questions about contagion when very large sums move through DeFi.

Takeaways

  • The episode raised risks to DeFi protocols from stolen collateral, emergency market freezes and large-scale laundering, but did not provide a view on the AAVE token or its price.
  • When assessing a lending protocol, consider how its emergency controls may affect users during a security incident.

THORChain

Context

  • The guests described THORChain as a route used to move and launder stolen assets across chains. They said laundering activity can make up an extremely large share of its volume on days when major hacks occur.
  • The protocol halted activity on several chains after an accounting issue involving an Ethereum reorganization. The episode also discussed restrictions on who can become a node operator, coordinated operator actions and unresolved questions about decentralization.
  • The FBI and other U.S. agencies specifically asked service providers, including THORChain node operators, to block transactions linked to the hackers. One guest warned of potential government scrutiny for parties that knowingly help launder stolen funds.
  • No THORChain token ticker or price outlook was discussed.

Takeaways

  • The speakers were strongly bearish on THORChain’s role in enabling laundering and raised reputational, operational and regulatory concerns. These are protocol-level concerns, not a token valuation analysis.
  • Investors evaluating the ecosystem should examine its governance, operator access, exposure to illicit flows and potential response to law-enforcement pressure.

Other blockchain networks named in the incident

Context

  • The transcript named XRP, Arbitrum (ARB), Avalanche (AVAX), Optimism (OP), Base, Tron (TRX), Solana (SOL), Polygon and Bitcoin among the networks or assets involved in the incident.
  • The guests said the breadth of affected networks pointed to compromised internal signing infrastructure rather than a single-chain vulnerability.

Takeaways

  • The episode did not offer individual investment views on these networks or their tokens. Its broader point was that multi-chain exposure can make an operational-security failure affect many assets at once.
  • Consider cross-chain and custody risks separately from a network’s technology or investment thesis.

Crypto lending and yield platforms (Nexo)

Context

  • A sponsor advertisement described Nexo as a digital-assets platform offering daily interest on crypto and borrowing against crypto. The ad said eligibility, geographic restrictions and terms apply; it did not provide interest rates or discuss the product in the interview.

Takeaways

  • Treat this as a promotional claim, not an independently assessed investment recommendation. Review the platform’s terms, eligibility rules and borrowing risks before using a crypto yield or lending product.
  • The episode’s broader discussion of hacks and frozen funds underscores that crypto yield and borrowing involve platform and custody risks.
Ask about this postAnswers are grounded in this post's content.
Episode Description
A compromised developer laptop and 50 pre-signed transactions let North Korea drain $6.3 billion from Binance. Jonty and Pablo Sabbatella trace how it happened. ======================================================== Thank you to our sponsor! Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients. Find out more at ⁠⁠⁠⁠⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠⁠⁠⁠⁠. Geo-restrictions, eligibility and terms apply. With Election Day on November 3, crypto voters could make the difference in close races. Check where candidates stand on crypto, verify your registration, and make your voting plan at Stand With Crypto’s Voter Hub. ======================================================== Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for. Our ⁠listener survey⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who finishes it gets a free month of Premium, Unchained or Bits + Bips, your pick. Open through Sunday, November 8. — Laura ======================================================== North Korea only needed 20 minutes to take $6.3 billion from Binance in the largest hack in history, not just crypto history. According to Binance, one of the attack vectors started with a compromised developer laptop, which ultimately led to the attackers being able to sign transactions from the exchange's hot wallets. Jonty, founder of Pangolin Intelligence, and Pablo Sabbatella, founder of Opsek, trace how an EIP-7702 upgrade let the hackers sweep those wallets, why roughly 43% of the funds were frozen compared with less than 3% after Bybit, and how Circle, Tether, Arbitrum's Security Council and Aave responded. They also debate how decentralized THORChain really is, why the FBI named THOR node operators, and how TraderTraitor lures developers with fake job interviews. With Chainalysis tying nearly 89% of this year's reported hack losses to North Korea, Pablo and Jonty lay out the security and anti-laundering steps the industry could take before the next attack. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guest: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty (tanuki42) - Founder of Pangolin Intelligence ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Pablo Sabbatella - Founder of Opsek Timestamps 🎬 00:00 Intro 📋 00:26 Unchained Survey: complete the listener survey at https://unchainedcrypto.com/survey 🚨 02:08 How North Korea took $6.3 billion from Binance in about 20 minutes 🔑 07:51 Why the EIP-7702 delegation made the drain faster 💰 17:35 Nexo: earn daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt 🗳️ 17:52 Stand With Crypto: see where candidates stand on crypto and make your voting plan at https://unchainedcrypto.com/go/standwithcrypto-yt ⛓️ 18:31 Which chains were hit and where exchange signing infrastructure fails 🏦 23:00 Should Binance have held $6 billion in hot wallets? 🧊 29:18 Why Circle and Tether moved fast to freeze the stolen funds 🏛️ 35:38 How the hackers borrowed nearly 20,000 ETH on Aave 🔄 40:37 Is Binance liquidity helping launder funds through THORChain? ⚖️ 45:51 How decentralized is THORChain after a three-vote halt? 🚔 54:19 What the FBI naming THOR node operators signals 🤖 01:02:33 Why the laundering trail looks machine-driven 🕵️ 01:06:06 Who TraderTraitor is and how fake job interviews hack developers 🛡️ 01:13:00 What the industry should change to stop North Korea Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.