theft

The founder of the blockchain security company Slow Mist, Yu Xian, posted on the X platform stating that many people, after watching the disclosure of the theft process by Binance, believe that the involved engineer made basic mistakes and had excessive permissions.Yu Xian indicated that such incidents belong to Advanced Persistent Threats (APT), involving human exploitation, intelligence reconnaissance, evasion of malicious code, trust chain exploitation, targeted lateral poisoning, cloud environment penetration, risk control bypass, and 0-day vulnerabilities, among other aspects. One cannot only focus on the initial social engineering phase.

According to a report by the Korean Central News Agency cited by the Korean News Agency, Kim Yo-jong, the Minister of the General Affairs of the Workers' Party of Korea, made a statement on the Binance hacking incident on the 4th, marking her second comment on the matter within three days.Kim Yo-jong stated that North Korea does not view the Binance hacking incident as an accidental or isolated event, but rather as an extension of Washington's hostile policy towards North Korea, with the United States attempting to gain political benefits from this incident. She expressed that "dialogue is clearly included" among the options for maintaining peace, but for North Korea, dialogue does not necessarily equate to national interests; there is no need for North Korea to sit down with "untrustworthy and hostile individuals," and she hinted at the possibility of taking strong countermeasures.Previously, on November 2, Kim Yo-jong had made a statement saying that the allegations were "a political provocation by the United States" and "absurd rumors." U.S. President Trump had previously stated that if North Korea was behind the hacking incident, he would communicate with North Korea about it.

ViaBTC mining pool and CoinEx trading platform founder and CEO Yang Haipo posted on X, commenting on the Binance security incident. He stated that the incident exposed at least three avoidable mistakes, which do not require complex technology; what is lacking is discipline.Yang Haipo pointed out that first, the development and operation environments were not completely isolated. Personnel with production environment permissions should use dedicated devices and not install third-party software; coding, chatting, and web browsing should be done on another device. Second, the operation and maintenance system lacked effective dual verification. A single key could operate production services, and once the key was leaked, attackers could gain full production access. He believes that production operations could be conducted in a manner similar to AWS browser-based Session Manager, using hardware security keys as a second factor to prevent a single credential leak from constituting a breach. Third, MPC multi-signature is merely nominal; the signers did not perform substantial independent verification of the transactions. Compromising one node could render the entire mechanism ineffective, resulting in the same effect as a single signature. Multi-signature is only effective when the signers do not trust each other, independently verify the transaction itself, rather than trusting upstream requests.On November 3, Binance released preliminary investigation results regarding the security incident on October 29. Binance stated that approximately $6.34 billion in digital assets were affected, and as of the update, about $2.85 billion had been frozen or intercepted, with 98% of the affected tokens having been replenished. The report indicated that attackers gained unauthorized access to the internal wallet signature service and exploited Ethereum EIP-7702 to authorize the hot wallet; due to the hot wallet using multi-party computation, it could not immediately revoke the relevant authorization with a single private key. Binance cited information from the FBI stating that North Korea is responsible for this incident.

According to a report by Central News Agency, a large-scale account abnormal transfer incident occurred at Yongfeng Bank in Taiwan. Preliminary investigations found 427 abnormal transactions, each amounting to approximately 100,000 New Taiwan Dollars, involving a total amount exceeding 40 million New Taiwan Dollars, affecting 419 customers.The related funds were all transferred to an account at Taipei Fubon Bank, which has now been temporarily frozen.

According to a report by The Paper, the People's Court of Xuhui District, Shanghai, sentenced a certain Zong to three years in prison, with a three-year probation, for the crime of illegally obtaining data from a computer information system, and imposed a fine of 40,000 yuan. This case is the first in Shanghai involving the use of AI to forge signatures and misuse large model computing power. Reporters from The Paper learned from the People's Procuratorate of Xuhui District, Shanghai, that by the time of the incident, Zong had illegally accessed the AI platform's interface over 290,000 times, with illegal gains exceeding 34,000 yuan.The procuratorial authorities introduced that in December 2025, after self-learning to access the AI platform's interface, Zong targeted a large model aggregation platform operated by an artificial intelligence company. He found an interface that was not open to the public and built a transit website to resell AI drawing and video generation services at low prices, while actually using the paid computing power of that platform in the background. He used AI to write an automated registration script, batch registering nearly 300,000 free accounts to obtain bonus points for new users, and bypassed IP registration restrictions.In January of this year, after the platform added electronic signature verification, Zong continued to use AI tools to create scripts to forge signatures and persistently call the interface. Two video and graphic design applications under the victim company saw over 4 million accounts registered from the same IP in a short period. After reporting the case in March this year, Zong was arrested. The prosecuting attorney stated that the involved platform had never provided API paid access services to the public, and the user agreement explicitly prohibited automated scraping and bypassing verification.

According to a report by Reuters, South Korean President Lee Jae-myung mentioned the recent theft of billions of dollars in cryptocurrency assets from Binance during a State Council meeting on November 3, calling for the establishment of a strong intergovernmental cybersecurity coordination agency to oversee security measures in both the public and private sectors.Lee Jae-myung stated that as AI drives increasingly complex hacking techniques, the existing security system, which primarily focuses on post-incident checks and responses, has shown significant limitations, and a proactive prevention mechanism must be established. The National Intelligence Service of South Korea has currently launched emergency security checks on over 2,100 central and local government departments and public institutions. Previously, the FBI in the United States attributed the Binance theft incident to North Korean hackers, but North Korea has denied involvement.

According to the Korean Central News Agency, North Korea mentioned in its denial of involvement in the theft related to Binance that last year the United States linked the hacking incident at the cryptocurrency exchange platform Bybit to North Korea. The Korean Central News Agency stated that the United States misled international public opinion, creating the illusion that cyber fraud occurring around the world was all orchestrated by North Korea, which is a serious political provocation against North Korea. North Korea firmly opposes any attempts to politicize cyber issues and use them as a means of interfering in the internal affairs of other countries, stating that this is the consistent policy position of the Democratic People's Republic of Korea government.The Korean Central News Agency also stated that it is necessary for the international community to reflect again on the fact that the current U.S. government announced the confiscation of illegally stolen cryptocurrency assets, acting as a national strategic reserve as soon as it took office last year. The Korean Central News Agency suggested that if the stolen massive cryptocurrency funds were to be recovered, one might discover clues related to the hacking incident. On February 21, 2025, Bybit experienced a large-scale theft incident, with a total value of approximately $1.5 billion. The U.S. FBI and several on-chain analysis agencies subsequently attributed the incident to the North Korean Lazarus Group (TraderTraitor).

Liquid Capital founder Yi Lihua stated that, based on the current situation, Binance's profits are sufficient to cover the losses from the recent theft, and there are no issues with asset security or liquidity, which is completely different from the FTX incident of the past. He believes that the core issue now is how trading platforms, including Binance, can prevent secondary theft.Market concerns are not just about the incident itself, but whether, in the AI era, the hacking capabilities have become unbalanced with the defense capabilities of trading platforms, and whether attackers have left other security vulnerabilities within the platform. He believes that trading platforms like Binance should provide users with detailed and reassuring security response plans.

According to BeInCrypto, Matt Hougan, Chief Investment Officer of the cryptocurrency asset management company Bitwise, stated that if a hacker attack of the same scale, amounting to $6.3 billion, had occurred ten years ago, it would have been enough to cause Binance to collapse.Matt Hougan mentioned that this is now considered a traditional cybersecurity incident and not a vulnerability of the Bitcoin blockchain itself, and it will not change the long-term trend of Bitcoin.

The United States Secret Service stated that investigators collaborated with industry partners within minutes after the incident to identify and freeze a large amount of stolen cryptocurrency, and the related investigation is still ongoing.

According to the on-site video released by the White House Rapid Response Team, U.S. President Trump stated in response to questions about the Binance theft case: "We are looking into the situation. We do not know if it was North Korea, but if it is, we will talk to North Korea about this matter."

According to a report from the Federal Bureau of Investigation (FBI), North Korea is responsible for the theft of over $6 billion in virtual assets that occurred around October 29 involving Binance. The FBI has referred to the related cyber activities as TraderTraitor.The FBI stated that it, along with the United States Secret Service and the Internal Revenue Service Criminal Investigation Division, has observed that the individuals involved primarily exchanged the stolen assets for ETH, and it is expected that further money laundering will occur through DeFi and instant exchange services.The three agencies have called on node operators, instant exchange platforms, DeFi services, and other virtual asset service providers to intercept and report transactions related to or originating from the addresses listed in the report.

According to Cointelegraph, Strive CEO Matt Cole stated that the approximately $6.3 billion theft from Binance has not changed his long-term investment judgment on Bitcoin. Considering the scale of the attack and the overall market weakness, the decline in Bitcoin's price was less than he expected, but it is still too early to determine whether the price has bottomed out. Currently, the price of Bitcoin is about $77,400, down about 4% from before the attack began on Thursday. Strive previously disclosed that as of October 23, it held 43,000 BTC.Cole compared this wallet attack to a bank robbery, rather than a failure of the Bitcoin network. Paul Chapman, the financial crime chief at Wirex, also emphasized that the attack targeted a company's system, not the Bitcoin network itself.Regarding future trends, Cole believes the market is in an "early spring" recovery phase, which may last another 6 to 9 months, with prices gradually rising rather than rapidly hitting new highs. He stated that this incident would not change his investment logic regarding Bitcoin over any reasonable time span.In terms of historical market reactions, after Bybit was attacked for $1.5 billion in 2025, combined with overall market volatility, Bitcoin fell from nearly $100,000 to about $95,000, a decline of about 5%. Additionally, according to CNBC citing Anchorage Digital data, in the past, after cryptocurrency trading platforms were attacked, Bitcoin's average decline in the first 24 hours was 8.3%.The investigation into the attack is still ongoing. Blockaid CEO Ido Ben-Natan believes that the attackers may have exploited Binance's trading signature process, as his analysis found a transaction containing 50 signature authorizations, with matching authorizations allowing the code controlled by the attackers to execute through the wallet. Binance stated that as of Friday, no evidence of wallet private key leakage had been found.

According to CoinDesk, Nasdaq-listed software company Next Technology Holding (NXTT) announced that its board has authorized the sale of approximately 5,833 BTC it holds, or to use these bitcoins as collateral for financing, valued at about $449 million based on the reported price.The company cited the theft from Binance, security vulnerabilities of trading platforms, and the potential threat of quantum computing to Bitcoin's cryptography as reasons for the decision, emphasizing that its bitcoins are not stored on Binance or held through Binance.The specific timing, price, and scale of the transaction will be determined by CEO Weihong Liu. The authorization allows for sales through trading platforms, private negotiations, or Bitcoin collateral financing, but does not guarantee that any transaction will ultimately be completed.NXTT closed on Friday with a market capitalization of approximately $7.8 million, and the disclosed value of its Bitcoin holdings exceeds 50 times the company's market value. The company's annual report stated that almost all bitcoins are held in custody by a Japanese institution, but the name of the custodian was not disclosed.

OKX's social media director, Haiteng, stated that some accounts are spreading the claim of "OKX being hacked," based on an on-chain transaction transferring funds from OKX to an "unknown wallet." He indicated that "unknown wallet" simply means that the on-chain monitoring platform has not yet identified the ownership of that address and does not imply that assets have been stolen; this transfer of 172 million USDT was an internal fund transfer conducted by OKX.Haiteng mentioned that OKX had previously issued a clarification through the same media channel, but there are still accounts interpreting normal on-chain transfers as hacker theft. He stated that when the industry faces security challenges, it is more important to collectively maintain trust rather than amplify panic with unverified claims.Haiteng also invited the on-chain monitoring platform Whale Alert to contact OKX, stating that the platform is willing to provide relevant address information to assist in improving labeling and reducing misunderstandings caused by unclear address ownership.

World Liberty consultant Ogle posted on platform X that it received a warning from the security company Blockaid, advising users to temporarily avoid visiting related websites or connecting wallets.According to the publicly available warning information, Blockaid stated that it has detected an active front-end attack related to the StepDrainer toolkit, involving Kintsu, Flap, and StonkBrokers. The affected sites have been injected with malicious scripts, and users clicking "connect wallet" may be redirected to a malicious asset theft page.Currently, Blockaid is investigating and gathering more information, and further updates will be announced later.

According to Bloomberg, U.S. President Trump stated that he is monitoring the Binance theft incident. In a live video from C-SPAN, Trump responded to reporters' questions on October 30 local time while meeting with an American citizen who had previously been detained by Russia in the Oval Office. When asked if the attack should be attributed to North Korean hacker groups, he said, "We don't know, we are investigating this matter."When asked if the stolen funds could be recovered, Trump stated that Binance claimed they would recover the funds and made assurances, "They said they have basically controlled the situation." He also mentioned that people can no longer see physical funds and that he has always felt this is "a bit dangerous."Binance experienced a security incident this week, affecting assets of approximately $6.3 billion, with on-chain analysis firms like TRM Labs attributing it to the North Korean hacker group TraderTraitor.

Zhao Changpeng responded to discussions regarding the scale of the theft at Binance and the reaction of BTC prices, stating that this $6.3 billion theft is the largest in terms of dollar value, but not when measured by the quantity of BTC. He cited the Mt. Gox incident, which involved 650,000 BTC, accounting for over 5% of the BTC supply at that time, emphasizing that assessing market impact cannot rely solely on dollar amounts.He believes that attention should also be paid to the number of affected users and the proportion of affected assets relative to user assets. According to him, in both the Mt. Gox and FTX incidents, nearly all users and their assets were impacted. The more critical issue is who ultimately bears the loss, whether the platform can fully cover it, rather than letting users suffer the losses.Zhao Changpeng stated that this incident remains a significant disaster for the industry, Binance, and himself, but they can withstand this shock. He emphasized, "The most important thing is that we protect our users."