On Thursday 29 October at 20:24 UTC, a single transaction on Ethereum sent 1.6 billion dollars in Tether, 167,464 ether and 62 other tokens from a Binance withdrawal wallet to an attacker. Three and a half minutes earlier, the attacker had taken control of that wallet with a permission carrying the wallet’s own signature, according to TRM Labs. Binance estimates the total impact at about $6.3 billion, across ten networks. In 2003, Saddam Hussein’s son had $1 billion in cash loaded onto three trucks. In $100 bills, Thursday’s sum would weigh about 63 tonnes. Tether blacklisted the attacker’s address 37 minutes after the transaction and froze 971 million Tether tokens. In Tether’s code, the address that function takes is named “_evilUser”. Circle froze 823 million USDC three minutes later. By 1 am UTC, Binance said about $3 billion had been frozen. Frozen is not returned: the attacker simply cannot spend it. Binance says it will cover all losses. Its first findings pointed to a compromised engineer’s laptop, and it has since reported additional points of breach. TRM Labs and Chainalysis attribute the attack to a North Korean hacking unit. Binance has not named anyone. The part no company can freeze: at 00:30 UTC, TRM counted more than 420,000 ether and 18,270 bitcoin still with the attacker, about $2.4 billion. The bitcoin sits in 19 wallets, and none of it had moved this morning. Some of the ether has. Sources: Binance (announcement and X posts), TRM Labs, Chainalysis, Tether, Circle, Arkham, CoinDesk, Decrypt, Cointelegraph, BBC, The Guardian, Ethereum and Bitcoin transaction records, Guinness World Records, US Bureau of Engraving and Printing. Checked 30 Oct, 12:30 CET. Narration: synthetic voice. Truck model: “[Riveria opettaa] Truck, Trailer and Forklift” by Jorma Rysky, CC BY 4.0 (Sketchfab), forklift removed. Cover: “Over $1,000,000 dollars in USD $100 bill stacks”, Flying Logos, CC BY-SA 4.0. #Binance #Crypto #Cybersecurity #NorthKorea #Bitcoin