Binance Faces $6.3B Security Breach; Bier Mocks CZ as ZachXBT Warns of Greater Risk

Binance Suffers Massive $6.3 Billion Security Breach, Industry Reels

The cryptocurrency industry is grappling with a significant security incident at Binance, the world’s largest exchange, sparking a flurry of memes, financial repercussions, and critical questions. The breach, which saw an estimated $6.3 billion in unauthorized outflows across multiple blockchains, has sent shockwaves through the digital asset landscape.

Questions Raised Over Exchange Leadership

The incident drew sharp criticism from prominent figures. Nikita Bier, former head of product at X (formerly Twitter), directly addressed Binance CEO Changpeng Zhao (CZ), stating, “The largest crypto exchange in the world just experienced the largest robbery in human history – and the person running it is a nomadic autistic man in Dubai posting ‘Funds are SAFU!’ What a time to be alive.” Meanwhile, Elon Musk commented, “Everyday is Zeroday.”

Technical Details of the Attack

Binance’s preliminary investigation suggests a compromised DevOps engineer’s laptop may have provided the attacker with access to a service container, enabling the submission of unauthorized withdrawal transactions. The exchange has stated there is no evidence of a wallet private-key leak. Blockchain investigators have identified the use of EIP-7702 authorizations, with one successfully matching the wallet’s changing nonce, allowing malicious code execution. The full attack vector is still under investigation.

Asset Freezes and Recovery Efforts

In response, Tether froze over $1.567 billion in USDT, and Circle froze more than $800 million in USDC, in coordination with law enforcement agencies. Arbitrum’s Security Council and other token issuers also intervened to freeze assets. Binance reported that its total frozen assets have approached $3 billion, though this figure is subject to change as recovery efforts continue, leaving a substantial amount yet to be traced and recovered.

Binance’s Response and User Confidence

CZ, who remains a major shareholder despite no longer running daily operations, acknowledged the incident appeared to be a hack and expressed confidence in full user coverage. Co-CEO Yi He confirmed that Binance would absorb the losses through its SAFU fund and company resources. Trading operations, including deposits, withdrawals, and Binance Alpha trading, were temporarily suspended for security checks.

Market Volatility and DeFi Impact

The breach triggered significant market volatility. Bitcoin briefly dipped near $76,300, liquidating approximately $478.9 million in positions, predominantly long trades. Ethereum saw $363.5 million in liquidations, with long traders also heavily impacted. Solana and XRP experienced liquidations of $82.1 million and $38.1 million, respectively. An exception was HYPE, which saw $31.3 million in liquidations with short positions bearing the brunt.

Decentralized finance (DeFi) platforms also felt the repercussions. Aave froze numerous markets across multiple networks as a precautionary measure, and Kamino paused SOL and BTC borrowing to mitigate potential exposure.

Links to Other Exploits and Potential Perpetrators

Blockchain investigator ZachXBT has identified a connection between the Binance and Bitget exploits, noting that stolen funds from both incidents converged at the same wallet address after passing through THORChain. This suggests a single attacker may be responsible for both breaches. The Bitget exploit was previously linked to the North Korea-associated group TraderTraitor, which has also been implicated in other hacks, including the Kelp DAO exploit. Further analysis by MistTrack revealed that stolen TRX from the Binance hack moved through the Bitget Wallet Swap Bridge to an address previously used by the Phemex hacker.