Binance Reaches for Its ‘SAFU Word’ After Hackers Swipe $6.3B in Crypto’s Biggest Heist Ever

Reason #5,898,921 I don’t mess with crypto… 

Somewhere in Pyongyang (which I hear is still lovely this time of year), hackers just pulled off the biggest crypto heist of all time… again. On Thursday, roughly $6.3B in client assets walked out the door at Binance, the world’s largest crypto exchange. That makes Bybit’s $1.5B job last year (and Binance’s own $570M breach in 2022) look like amateur hour at the hacker hostel.

About $3B has been frozen on-chain so far, and Binance says it’s clawing assets back. It also pledged to pony up for the rest out of company funds and its Secure Asset Fund for Users, aka SAFU (think: a rainy day fund for exactly this kind of sh*t). Small problem: SAFU holds roughly $1.2B, all of it in bitcoin.

Meanwhile, Donny’s favorite pardon (read: founder Changpeng “CZ” Zhao) hopped on X to let everyone know that “User funds are safe!” Which means it’s definitely time to start panicking…

Obviously, withdrawals are paused while Binance rebuilds its withdrawal security, with a restart expected within 48 hours. Deposits, of course, are still wide open.

So whodunnit?

Binance hasn’t named anyone. But blockchain sleuths at TRM Labs and Chainalysis both pointed at TraderTraitor, North Korea’s go-to crypto heist crew. Per TRM, the scam bois ran the same playbook they used on Bybit and April’s KelpDAO hack (honestly, so did we). Think tiny Tornado Cash withdrawals to fund the getaway wallet and signatures collected in advance (read: pre-approved withdrawal slips, I think), all fired off at once. Most of the money moved in about 20 minutes.

As for how they got in, Binance initially blamed a compromised DevOps engineer’s laptop that let the attacker into a service container. Co-CEO Richard Teng, the ex-regulator Binance hired to be the adult in the room, later said it was way more complex than one employee’s permissions. Binance also says it found “no evidence of any wallet private key leak,” which, comforting.

Friendly reminder, CZ stepped down as CEO in 2023 and pled guilty to letting bad guys launder money failing to maintain an effective anti-money laundering program as part of a $4.3B settlement. He did four months in prison for it before Donny pardoned him last October. Now Binance gets to watch North Korea launder its money instead, which, poetic.

Turns out, most of that $3B was frozen by the stablecoin crowd, not Binance. Tether froze more than $1.5B of its USDT and Circle froze over $800M of USDC, while Ripple is freezing its RLUSD. Satoshi be like, “look how they massacred my boy.” Circle shares still got dunked on to the tune of about 5% after hours Thursday.

Oh, and everybody’s favorite sh*tcoin took a 4%+ L, sliding to $77,994.96 on Friday. So yes, the hack also shrank the fund that’s supposed to cover the hack.

So yeah… Kim Jong Pwn (read: Kim Jong Un) has officially shown his pull-out game is strong. In and out in 20 minutes, and he didn’t even stick around to cuddle. Do you know where your crypto is? 

Until next time, friends… 

At the time of publishing, Stocks.News does not hold positions in companies mentioned in the article.