Elon Musk

Wallet Swap

ZachXBT

Nikita

The Binance hack has given the crypto industry one of those moments when the memes, the money, and the uncomfortable questions all arrive at once.
Nikita Bier, X’s former head of product, didn’t hold back either. Taking a direct swipe at CZ, he wrote,
<blockquote>
 “The largest crypto exchange in the world just experienced the largest robbery in human history – and the person running it is a nomadic autistic man in Dubai posting “Funds are SAFU!” What a time to be alive.”
</blockquote>
Meanwhile, Elon Musk said that “Everyday is Zeroday.”
<h2 id="inside-the-binance-hack">Inside the Binance Hack</h2>
On October 29, Binance <a href="https://cryptopotato.com/binance-suffers-6-3-billion-hack-pledges-to-cover-all-user-losses/" rel="noopener noreferrer nofollow">suffered</a> a major security incident with an estimated impact of approximately $6.3 billion, according to the crypto exchange’s own update. On-chain investigations traced billions in unauthorized outflows across multiple blockchains, including Ethereum, Bitcoin, Tron, Arbitrum, Optimism, and Avalanche. The important detail is that Binance’s preliminary investigation points towards a compromised DevOps engineer’s laptop, which may have allowed the attacker to access a service container and submit unauthorized withdrawal transactions.
Binance says it has found no evidence of a wallet private-key leak. Blockchain investigators also identified the use of EIP-7702 authorizations, with 50 signed authorizations submitted in an attempt to match the wallet’s changing nonce. One successfully matched, which allowed malicious code to execute against the affected wallet. The investigation is still ongoing, so the complete attack pathway has not yet been officially established.
Tether froze more than $1.567 billion in USDT, while Circle froze over $800 million in USDC in coordination with law enforcement. Arbitrum’s Security Council also intervened to freeze assets, alongside other token issuers. Binance’s reported frozen total has approached $3 billion, although the exact figure has changed as recovery efforts progressed. That still leaves a substantial amount to trace and recover.
CZ, who no longer runs Binance but remains a major shareholder, said the incident did look like a hack and expressed confidence that users would be fully covered. Co-CEO Yi He also confirmed that the crypto exchange would absorb the losses through its SAFU fund and company resources. Deposits and withdrawals were temporarily suspended while security checks were conducted, and Binance Alpha trading was also paused.
But the shock traveled well beyond Binance. Bitcoin briefly fell near $76,300, <a href="https://cryptopotato.com/bitcoin-crashes-to-76k-1-5b-liquidated-after-cryptos-biggest-hack/" rel="noopener noreferrer nofollow">wiping out</a> nearly $478.9 million in positions, 84.6% of which were longs. Ethereum wasn’t far behind, recording $363.5 million in liquidations, with long traders accounting for 83.5%, according to Crypto Patel’s estimates. Solana followed with $82.1 million, while XRP saw $38.1 million wiped out. HYPE was an interesting exception, with $31.3 million in liquidations and short positions taking the heavier hit.
DeFi felt the shockwave too. Aave, for instance, <a href="https://x.com/aave/status/2115937863162339637" rel="noopener noreferrer nofollow">froze</a> 175 markets across 16 networks on V3, along with another 117 markets on V4, as a precautionary measure. Kamino also paused SOL and BTC borrowing to limit potential exposure.
<h2 id="same-hacker-behind-both-exploits">Same Hacker Behind Both Exploits?</h2>
ZachXBT has <a href="https://x.com/zachxbt/status/2116030284261179538" rel="noopener noreferrer nofollow">found</a> a link between the Binance and Bitget exploits. He said that the stolen funds from both incidents <a href="https://cryptopotato.com/how-zachxbt-infiltrated-a-crypto-laundering-network-handling-bybit-and-other-stolen-funds/" rel="noopener noreferrer nofollow">ended</a> up at the same wallet address after passing through THORChain. The popular blockchain investigator believes this points to the same attacker being behind both hacks.
The Bitget exploit was previously linked to North Korea-associated group TraderTraitor, which has also been connected to other incidents, including the Kelp DAO exploit. MistTrack also found that stolen TRX from the Binance hack moved through Bitget Wallet Swap Bridge to an address starting with 0xCd68. That wallet had previously been used by the Phemex hacker.
UPDATE: Bitget Wallet later revealed that the team has partnered with Binance to identify and disrupt illicit fund movements. Some of the actions taken by the team, according to a spokesperson, include:
• Blacklisting flagged wallet addresses • Real-time onchain monitoring &amp; screening suspicious txns • Proactively providing real-time updates on fund movement from our explorer to the Binance security team • Coordinating with bridge providers, liquidity partners &amp; security teams to restrict further movement wherever technically possible
The post <a href="https://cryptopotato.com/binance-hit-by-a-6-3b-security-nightmare-nikita-bier-mocks-cz-while-zachxbt-spots-a-bigger-threat/" rel="noopener noreferrer nofollow">Binance Hit by a $6.3B Security Nightmare: Nikita Bier Mocks CZ, While ZachXBT Spots a Bigger Threat</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Binance Hit by a $6.3B Security Nightmare: Nikita Bier Mocks CZ, While ZachXBT Spots a Bigger Threat

Table of Contents

CryptoPotato_News

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!