Inside the hour that froze $2.3 billion: the night the Binance hack unfolded

Binance on November 3 described how attackers used its own internal AI tool to reach two wallet engineers, and the reconstruction of the October 29 heist shows stablecoin issuers froze more than $2.3 billion within about an hour of the alarm.

One researcher, two issuers, thirty minutes

The attackers moved just after 4pm New York time on October 29, draining wallets across at least four blockchains. At 4:38pm, researcher Taylor Monahan of the security collective SEAL suspected the worst and contacted Tether, the issuer of USDT. Tether and Circle, which issues USDC, began freezing transactions less than 30 minutes later, per a minute-by-minute reconstruction of the response.

Circle CEO Jeremy Allaire announced at 5:18pm that the company had frozen more than $800 million tied to a potential Binance exploit. About seven minutes later, Tether CEO Paolo Ardoino announced more than $1.5 billion frozen. Both issuers can blacklist stolen stablecoins on their own chains, which is what turned a fast-moving drain into a slow one.

Binance's long night

Binance publicly acknowledged it was aware of a potential security issue" at 5:15pm and was investigating. The company then built a war room that grew to about 100 people worldwide and coordinated with the FBI and the US Secret Service, which are part of the probe into the largest crypto theft on record. Chainalysis has called the incident the largest in the history of crypto, and one of the single-largest financial crimes of all time. Ari Redbord, global head of policy at the blockchain intelligence firm TRM Labs, put it more bluntly: It's the largest bank robbery in human history."

How the attackers got in matters for what happened next. Binance's November 3 security report says they used a compromised employee computer and the company's internal AI tool on October 20 to take control of two wallet-infrastructure engineers, then obtained a container deployment permission token to penetrate wallet-signing operations through a laptop, not a smart contract on October 29. The report says its investigation does not establish that an AI model autonomously planned or executed the theft.

The money, so far

Binance said October 30 it could easily reimburse any losses, and on October 31 it pledged to reinstate customer withdrawals. Its November 3 report puts frozen or intercepted assets at about $2.85 billion of the $6.34 billion affected, and says the exchange has rebuilt the affected infrastructure and commissioned an independent cybersecurity review.

The post Inside the hour that froze $2.3 billion: the night the Binance hack unfolded appeared first on Techreport.