Fact Check: Binance $6.3 Billion Hack and Crypto Security Claims

So, Bitcoin is crashing because we just experienced the biggest heist in crypto's history. And I wanted to put

this out as an emergency video because this is not just Binance. This is happening to supply chains of hardware

wallets across the whole industry. Coins like Ethereum, Bitcoin, Tron, and dozens of different tokens were stolen from

Binance. By the time anyone could react, billions were gone, and Binance now says the total impact is around $6.3 billion.

A security incident impacting billions of dollars of funds has hit the world's largest crypto exchange, Binance,

triggering emergency asset freezes and sharp losses in the price of digital tokens. This is overall very bad for the

crypto industry. And as a result of this, of course, Binance has frozen all withdrawals pending investigation.

There's a lot of questions of customers who say their life savings are on these exchanges. and Tether and Circle have

also frozen about $3 billion of the stolen money, which is good news. But that also leaves a lot of questions,

[music] like whether our money is safe on these exchanges at all, and was this possibly an inside job. There's even

rumors that it could have been a nation state like North Korea, or maybe it was the work of some agentic AI, and that

this is all just the beginning. This is coming to a lot of other exchanges as well. So, there's a lot to go through.

So, in this video, I want to walk you through exactly what we know happened and how you might want to protect

yourself going forward because in this new age of technology, I think anything that can be hacked will probably be

hacked at some point or another. So, with that said, let's get into it. Hi, my name is Andre Jick. Hope you're doing

well. Come for the finance and stay for the yearly reminder to never keep your crypto on exchanges. So the reason I

wanted to make this video besides explaining what's happening is to hopefully help you understand how to

think about security in the future. So the first thing we need to understand is how an exchange like Binance actually

holds our money. See, exchanges keep most of their crypto in what's called a cold storage wallet. Think of it like a

bank vault. It's offline and it's very hard to break into. But because they're an exchange, they also need money on

hand to process everyone's withdrawals. And that needs to work instantly, which is also why they keep some of it in

what's called a hot wallet. Now, a hot wallet is more like a cash register. It's connected to the internet, and

money is going in and out of it constantly. In this instance, that wallet that was attacked was called

Binance 14. Apparently, it's one of Binance's most busiest wallets because it's processed something like 31 million

transactions. Now, here's how the heist actually happened. According to what we know so far, see, the day before this

happened, a brand new wallet was funded through something called tornado cashache. Tornado cash is what's called

a mixer. A mixer is where you put crypto in and it comes out the other side with no trail back to where it came from.

It's kind of like taking a deck of cards and then shuffling it in all sorts of crazy ways, thus losing the playing

card. It's basically the crypto equivalent of paying in cash that's untraceable.

Typically, no legitimate exchange funds its wallets in this way. So that was kind of like the first red flag. Now

that same wallet also built a tool designed to empty a wallet of everything it holds in one sweep. So think of it as

kind of like a robot. In fact, after they built it, the attacker did a test run using this technique. They set up a

few wallets of their own and they practiced it and it actually worked. Now, this is where it gets kind of

technical, but here it goes. Every time Binance 14, that wallet, sends money out, it takes a ticket number, kind of

like how it says now serving number 47 when you're at the DMV, right? It is constantly serving new customers. So,

that number is always changing. Now, Ethereum, because it's programmable money, has a feature that lets a wallet

give its control over to a program, like a permission slip that says, "Let this robot run my counter." Now, that slip

only works if two things are true. It has to be signed by Binance and it has to be printed with the exact ticket

number being served at that exact moment in time. Now, the attacker somehow managed to get Binance's signature on

these permission slips, but because they couldn't know ahead of time which number would come up, they brought 50 different

slips, all with different numbers. Now 49 of those got rejected but one of them was a match and with that one match the

robot was running the cash register. That's how they were able to sweep Binance 14 and take about 167,000

Ethereum worth about $1.6 6 billion in Tether and 61 other tokens all in just one transaction that was in total worth

roughly $2.5 billion at the low low cost by the way of just $93. Now moments later the internet started

to notice that something was off. An onchain analyst spotted this and he posted about it but the attacker was

already moving the coins. See, by that point, they had already moved about $195,000 Ethereum to a brand new wallet.

Then another Binance wallet sent $780 million in USDC to the attacker again. Within the hour, Tether locked up the

stolen USDT, Circle locked up the USDC, and about $2.4 billion was frozen. It was at that point when CZ posted that it

looked like a hack and that user funds were safe. Binance then issued a statement saying it's investigating a

potential security issue. Still not confirming a hack, but the hack did not stop there. In fact, the attacker did

something very interesting and allowed them to continue stealing as this was developing. See, when the robot emptied

the wallet, it didn't take everything. It left exactly one ETH behind, which was just enough for the wallet to keep

working. So that when new money was deposited, the wallet was instantly swept. Because it stayed open, Binance's

automated systems kept doing what they always do, which is collecting customer deposits and refilling the hot wallet.

So that is in a nutshell the technical version of what happened. Now the obvious question is hold on how exactly

did the attacker get finance to sign those slips in the first place and was that possibly an inside job? So

governments everywhere are paying more to borrow. But so are you. And unlike a government, you can't print the

difference. The rate you get on a mortgage, a car, and pretty much everything comes down to your credit.

Which brings me to the sponsor of today's video, Kickoff. When my parents moved us to the US, I didn't know

anyone. I didn't speak English, and we had zero credit history, and that's the catch 22 nobody talks about, which is

that you need credit to get credit. Kickoff is a credit building tool designed for exactly that problem.

There's no credit check to apply, no interest, and no hidden fees, and you can sign up in a few minutes. You pick

one of their monthly plans, which start at just $5 a month. You make your payment on time, which is easy with

autopay. and kickoff reports those on-time payments to all three credit bureaus. It's designed around two key

factors in your credit, payment history and utilization. And to be clear, this is a line that exists only to build

credit, not for spending money elsewhere. Kickoff users with credit under 600 who made on-time payments

increase their credit by an average of 25 points in just their first month and up to 86 points after their first year.

And it's the number one credit building app on the app store. And better credit generally means you pay less interest.

And that's money that stays in your pocket instead of the banks. So if your credit is holding you back, Kickoff is

giving my audience 80% off your first month, which works out as low as $1. Click the link in the description or go

to getkickoff.com/andre. Thank you to Kickoff for sponsoring this segment. And now let's get back to it.

So here's how the attacker was able to get those slips signed. Now going into this, at first there were only three

ways it could have happened. The first way is that someone stole Binance's private key, which is basically the

master password to their wallet. Possible. The second way is that someone tricked Binance's system into signing

something that they shouldn't have. Or the third way, it was an inside job and someone helped the attacker. But how

this actually happened, according to Binance's initial investigation that they just released, is that a DevOps

engineer's laptop was compromised. And this is basically one of the people who maintains Binance's internal systems and

from his laptop, the attacker got into one of Binance's internal services and then used it to submit unauthorized

withdrawal transactions. So, the attacker never really stole the keys to the vault. They just got inside the

system that used the keys, which I think is exactly what those 50 permission slips were all about. Because if they

had Binance's master key, they would not need to use up all those 50 guesses. You would just look at the number being

served, you would sign the perfect slip, and then you'd be done. But if you get inside Binance's system, getting it to

sign things for you, then you'd have to grab them ahead of time, then hope one of them works. And because all of this

happens on a public blockchain, every one of those 50 slips is just sitting there for us to look at right now, which

is why 49 of them are marked invalid and only one of them is marked success. And that is all it took. It also actually

explains why around 18,000 Bitcoin and hundreds of millions of dollars on the Tron network also left Binance's wallets

during this window, too. Because the permission slip trick I just explained, it does not work on Bitcoin or Tron. But

once they were inside the system that approved the withdrawals, they were not limited to just one cash register. They

could do it for multiple blockchains. Now, what Binance has not told us yet is how that laptop got compromised in the

first place. And that's where the North Korea rumors come in. Because compromising an employes's computer

through malware or a fishing link or even a fake job interview is exactly what North Korea has done in the past.

It is almost exactly what happened with Bybit last year. The hackers did not steal Bybit's keys either. They

compromised a developer machine at the wallet software company that Bybit used so that when their team signed what

looked like a normal transfer, they were actually giving up $1.5 billion. In fact, the FBI attributed that attack to

North Korea. Ironically, just 2 days before this attack happened, Binance said its security team blocked several

North Korea linked cyber attacks. Now, as of right now, this is all speculation because nobody's officially attributed

this to anyone, but I think either way, this raises a much bigger question. A single engineer, compromised or not,

should not be able to put $6 billion at risk. How is it that one laptop was able to do this much damage? Binance says

it'll publish a full technical breakdown once the investigation is complete. But either way, all of this really brings me

to the most important question in this video, which is, is our money even safe in crypto anymore? So, the good news

about all of this is that if you have money on Binance right now, you're probably going to be okay? Because even

though over $6 billion left Binance's wallets, about 3 billion of that was already frozen thanks mostly to Tether

and Circle. And the founder of something called DeFi Llama, which tracks all of this, estimates that the real loss is

probably going to be closer to about a billion, which CZ actually reposted and said the loss might be slightly higher,

but that it will be fully covered, which is great news. By the way, to put a billion dollars in perspective, Binance

holds roughly $144 billion in customer assets. So, even a billion dollar loss is way under 1% for them, which hurts,

but it's not going to break them. In fact, Binance also has an emergency fund for events like this one. It's called

Safu, which stands for secure asset fund for users. And they actually used it back in 2019 when hackers stole about

7,000 Bitcoin and Binance covered the whole thing. Today that fund holds roughly 15,000 Bitcoin, roughly about

1.2 billion. So on paper, about the same size as this loss. There's only a couple caveats though that you should know

about. Part of that fund is reportedly being held as required capital for regulators in Abu Dhabi. So, not all of

it might be free to use and Binance's promise to top the fund back up only applies if it drops because Bitcoin's

price falls, not because they had to pay out a hack. So, realistically, if Binance does cover this, which I think

they will, it's probably going to come out of their own pocket. Not just the emergency fund, but either way, user

funds should be safe. Now, in the meantime, Binance has paused withdrawals on several networks as a precaution

while they investigate, which is totally understandable. But if you're someone who's trying to get your money out right

now and you can't, that is scary. And that brings me to the point of this whole video. When you keep crypto on an

exchange, you don't actually own that crypto. Remember, you own an IOU. You own a promise from that exchange that

they will give it back when you ask. Now, thankfully, Binance is big enough to cover the loss, but a smaller

exchange might not be able to. And I say this because I've lost over 10 Bitcoin on a smaller exchange that went

bankrupt. So, that was my learning lesson to never keep money on an exchange, no matter how much they entice

you with interest. Now, there's also one more element to this story that I think people are kind of missing. Everyone is

celebrating the fact that Tether and Circle froze $2.4 4 billion in under an hour. And in this case, that's a good

thing, right? But what that also means is that those companies behind these stable coins can also freeze billions of

dollars almost instantly whenever they decide to. Now, luckily for now, that power was used against a thief. But that

same button works on everyone, and that's something you have to be careful of. So, the question is, how do you

actually protect yourself? It's crazy because about a year ago, I made a video where I said, I thought they would be

coming for our Bitcoin. I think the goal is to centralize as much of it as possible into the hands of the central

planners and put our money into their securities instead. They would love us to buy the ETF versions of Bitcoin so

they can hold it and promise us protection. I also said that we'd most likely see more and more attacks and

they would give us more incentives to hold their products. And while they incentivize us to move our money into

their ecosystems, they would want to self-custody their coins for themselves. And we're seeing all of this play out

with fear, uncertainty, and doubt in the meantime. So the question is, how do you actually protect yourself? And here's

how I do it. If you have a sizable amount of crypto at this point, the only thing I really trust is what's called a

multi-IG solution wallet. Now, I'm not going to go into the technical details here. If you're interested, I'm sure

I'll have a video of that explaining it soon in the premium member section. But other than that, if you're actively

trading something, your money does not need to be on an exchange. Move it to a wallet where you hold the keys, like a

hardware wallet. Now, unfortunately nowadays, even that is risky. There was an incident with a wallet called Cold

Card Q. There are also reports of ledger wallets being drained because of supply chain attacks. There is now so much

money in crypto. We are seeing extremely sophisticated attacks on our money. So if you do buy a hardware wallet, please

buy it directly from the manufacturer. Never buy a used wallet obviously, but never buy from a random seller or an

Amazon or eBay. And if you do keep money on exchanges, and I know a lot of people do and I understand that for trading,

please only keep what you're actively using and spread it out. Don't put everything on one exchange, no matter

how big that exchange is. And also turn on every security feature that they offer, including two factor

authentication with an authenticator app or a physical security key, not text messages, please. And while you're at

it, you can also withdraw whitelist addresses so your crypto can only be sent to the addresses that you've

approved. Now, this is just me personally, but I also do not trust DeFi or decentralized exchanges because

they're safe until they're not. And then we get some headlines saying AI broke the website and drained all the wallets

somehow. So, in the meantime, please be very careful in the next few days because scammers love these kinds of

events. After every major hack, there is an influx of fake support messages and fake compensation forms. Always

remember, no one legitimate will ever message you to help you recover your money. And also, never copy a wallet

address from your transaction history because scammers are actively sending fake tokens from lookalike addresses,

hoping that you'll copy the wrong one by mistake. And lastly, also understand what you're holding. Stable coins like

USDT and USDC are also IUS and as we just saw they can be frozen too. Now in this case they protected Binance but

it's worth knowing that this same feature applies to everyone. Now to be fair self-custody is not risk-free

either. If you lose your recovery phrase no one can help you get it back. So, please make backups on things like those

titanium plates and steel plates and also add those 25thword passphrases to make it extra secure. I'm sure I will

make videos about this in the future in the premium members section. But if you're interested, all of that will be

down there. I post my extra thoughts and I also post a day early. It allows me to take on fewer sponsors and make more

videos like this. If that's useful to you, the link is down below. Thank you so much for watching. I'd love to see

you back here next week. Stay safe and I'll see you soon.