[00:03] cryptocurrency are gone in a major heist. The the largest cryptocurrency heist. The the largest cryptocurrency heist ever. And it might have literally heist ever. And it might have literally nothing to do with an AI hack or a
[00:18] failure in cryptocurrency. Instead, it might have everything to do Instead, it might have everything to do with the North Koreans and a laptop. Yeah, if this sounds like a movie plot, huh, buckle up. Grab a monster or a beer
[00:36] and let's get into what just happened here. We're going to break it down in a simple and easy to understand manner. But this is a problem because even though 40% has already been frozen, got frozen within about an hour of the hack
[00:51] beginning, well, the other 60% certainly some of it's gone, but uh the certainly some of it's gone, but uh the other 60% of it TBD. Now, the problem other 60% of it TBD. Now, the problem with this is it is early still. We don't
[01:04] to do our best to give you what we know now and what this means for the market and cyber security and how to prevent falling victim to these sort of attacks falling victim to these sort of attacks because this was probably an attack of
[01:17] human engineering or an attack on a human engineer or a human engineering human engineer or a human engineering attack on a human engineer. Yes, that'll make sense soon enough. But first, let's understand what the heck happened here.
[01:31] So, at about 1:20 p.m. Pacific time, so about 20 minutes after the market about 20 minutes after the market closed, an attacker got into Binance's number 14 wallet, which was an Ethereum hot wallet, and they used a trick inside
[01:46] of the Ethereum improvement protocol 7702. That was a 2024 proposal, which ended up going through in May of 2025. But anyway, they used a trick in here to
[02:00] get a lot of Ethereum out. But once they were inside, which they had already gotten snuck inside of the laptop, they didn't just have access to Ethereum. They had access to all the other, frankly, easier coins and tokens to get
[02:15] out of a system once you're on the inside. They got Tron, they got Pepe, they got a USDC, they got Tether, they got Bitcoin, you name it. Now, we'll go
[02:27] through how this worked with some of the signing authority in just a moment, but here's something really important to know. These were hot wallets that got hacked. There were multiple of them. Hot wallets are really common at brokerages
[02:40] because if you are going to use a brokerage to transact crypto, and you're like, I'm going to pop in. I'm going to sell some crypto. You don't want to wait two or three days for a human to approve every transaction. So somewhere some
[02:54] dude's literally got a laptop running. Your request comes in. It looks like it's coming from your legitimate account and there are automatic signing
[03:06] protocols. Boom. You've got the capital. They send the money out. Boom. Done. Simple. These get automatically signed on these laptops. They have to be
[03:18] from the outside. when they're coming from the inside, the legitimizing is way easier. And this is why somebody getting easier. And this is why somebody getting access to that laptop is critical. Now,
[03:31] worth noting when I say hot wallet, hot wallet just means it's connected to the oversimplification. Technically, a cold wallet is supposed to be considered not connected to the internet and therefore not subject to
[03:46] hacking. But I'll just give you a quick little sample. Okay, even cold wallets have been hacked. We had the cold card randomness flaw where all of a sudden their firmware was broken and what was supposed to be random wasn't actually
[03:59] and hack these cold wallets. That's not great. The worst one was the Ledger hack. Oh boy. Uh people actually intercepted Ledger cold wallet
[04:11] shipments, cracked them open, soldered in spy chips and SIM cards into these cold wallets. basically turning them into hot wallets that connected not only
[04:23] to the internet but also captured your private key and broadcast it to whoever was listening on the internet. That's nuts. So like just saying, you know, you
[04:35] could feel safe on a cold wallet, it might not actually be safe. And then it's like, oh well don't keep stuff on exchanges because they get hacked. And I'm not here to shill for an exchange, but at least typically they offer some
[04:49] but at least typically they offer some form of safety net like the SEFU funds at Binance. We'll talk about that in a moment. Are your funds really safeu? I have my skepticisms about that. Uh, but then there's an example of like FTX,
[05:02] which suffered a bank run, but everybody ended up getting their money back. It money back because people had to sort it all out. H that's a mess, too. So, you know, usually we're like, ah, not your
[05:14] then you're also getting these cold wallet hacks. It's it's a little bit of a mess right now. It just doesn't feel safe right now. It doesn't feel warm and fuzzy right now. So, once this wallet got hacked, uh, we
[05:30] ended up seeing about $2.5 billion leave the wallet within 4 minutes, which is the wallet within 4 minutes, which is insanely fast. This wallet sent,000 Ethereum. That's like $360 million worth of Ethereum right there out. At the same
[05:46] of Ethereum right there out. At the same time, it sent 1.6 billion USDT. So, Tether out, plus 62 other tokens all out to a fresh address. Boom. 2.5 out to a fresh address. Boom. 2.5 billion move within 4 minutes of getting
[06:01] like uh Oceans 11 or something like that. You know, somebody standing there with a clock and and like guiding people with what to do. four minutes they got $2.5 billion out. That was like 40% of the hall right there. But then Binance
[06:15] 16 ended up sending 28,000 Ethereum to the same address plus another 780 the same address plus another 780 million USDC plus another 43 million of other tokens. And then a second sweep came in about 24 minutes later pulling
[06:29] another 200 million out because this hole was actually open for 80 minutes anytime new money showed up to these wallets to get liquidated, like you money out and transfer money through these hot wallets at the Binance
[06:44] exchange, world's biggest crypto market exchange. Well, boom, just went right longer that window was open, the more they were just able to vacuum up all the they were just able to vacuum up all the money coming in. Kind of crazy. Now, a
[06:59] lot of people are like, "What? The H double hockey sticks? How? How? How? How double hockey sticks? How? How? How? How could you literally get access almost could you literally get access almost unfathered access to billions of dollars
[07:13] worth of crypto? Well, this is where we get into the human engineered hack because right now these people probably through human engineering social
[07:25] trickery made off with somewhere between three to 3.2 billion dollar. Yeah, sure, three to 3.2 billion dollar. Yeah, sure, two and a half's frozen, but who cares? You got three billion of other money, and we're not entirely sure yet exactly
[07:39] how much truly is gone. For example, there was initially this opinion that, oh, maybe the money that was getting moved around via Bitcoin or Bitcoin that that Binance was moving in the the shuffle in the kurfuffle that was going
[07:54] on like, oh, they'll move it. But they've already confirmed that the Bitcoin movements were indeed malicious, which is not great either. Just to kind of show you, this hack right here once the final numbers land is likely to be
[08:08] the largest ever. It certainly already appears to be well greater than the 2025 appears to be well greater than the 2025 by bit hack. Not great. Okay, so who's behind this and how did this break down? Well, Binance actually said 2 days ago
[08:24] that the North Koreans were after them. Now, this is really interesting because Binance actually bragged that they had successfully identified and blocked North Koreans from taking multiple attempts to take over computers at
[08:43] Binance. Huh. So, everybody thought the coast is clear. Turns out they were likely already inside. Small note though, if already inside. Small note though, if you want to bet on Bitcoin getting back
[08:57] over a h 100,000, I will say it is down quite a bit right now on the odds of Bitcoin crossing $100,000 again before December 2026. Just saying if you think this is going to pop back up because
[09:11] some money gets recovered or maybe there's an Iran deal and there's some actual risk on rally again which doesn't you know seem super likely right now but you could do that over here at Khi just an 8% chance and even if these odds
[09:25] double to 16% you make some dollars on that. I kind of tempted by this, man. You could even go out to January over here, you know, get get through sort of the uh postelection euphoria that usually comes, maybe get a deal with
[09:39] Iran. These option, both of these are starting to look a little cheap. And I hold them to the end, but I'm kind of thinking to myself like I'm a little tempted. I don't know. Maybe maybe I'mma buy one of those positions and uh and
[09:52] you know, just exit on a double of those. I I don't know. But if you do, make sure you use our code to sign up for Cali. They are a spa a paid sponsor of my startup Reinvest. Go to kshi.com/r/meet
[10:06] and make your first trade. You can also scan this QR code uh or use code meet Kevin when you sign up. So here's what Binance says. Binance says they have Binance says. Binance says they have initially successfully identified a
[10:21] contagious interview campaign where basically fake engineers sent a coding test that would have end up installing malware on engineer computers engineers computers. And so the idea here is some if somebody's coming to you going, "Hey,
[10:35] you know, here's a life-changing opportunity. I found you on LinkedIn. You know, maybe you make a h 100k working over there or you make $50,000, whatever it is. Here's an opportunity to make $300,000 or 250 or whatever it is,
[10:50] than what you're making now where you're like, "Oh my gosh, this would be life-changing. I'd love to make so much more money." And so what ends up happening? Well, these folks think this is a legitimate recruiting agency. No
[11:04] problem. I'd love to take your coding test. I may as well sus out what that offer could be. But if you end up taking this other job coding test on your Binance laptop that's also sending out signatures for cryptocurrency
[11:19] transactions, you might be installing malware right inside of the castle. And Binance said North Korea was trying and they got nothing, the very day after the announcement, the wallet that ended up being the uh
[11:35] thieving wallet started sending some money through tornado cash to set up money through tornado cash to set up their gas fees. And so within 38 hour, it was about 37 hours from their first tornado cash transaction to the end of
[11:52] tornado cash transaction to the end of the hack. these people or the Koreans, the North Koreans or whomever ended up making off with about $3 billion. Here's just sort of the time frame here. 37 hours from first deposit to the
[12:06] sweep. You see the transaction here on the 28th. Few sweeper contracts coming in. This is where a transaction first strikes on the Ethereum improvement a moment. Here's where we get a really big sweep. This is of course when we get
[12:22] in through that authorization uh Ethereum protocol that's for Ethereum. apparently because of this malware likely. Uh then at uh 8:41 uh you end up getting the opportunity to pull more money uh out. We've gone
[12:39] through some of these polls. A lot of these coming out of Binance 14 though some say Binance 16 was also affected as well as potentially Binance Hot Wallet 34. So, multiple potentially exposed as these people had access to the wallet.
[12:53] It's likely they've had access for days and they planned out exactly what they were going to do at every exact minute after this hack began. That's how everything moved so fast. That's how they socially engineered in. Now,
[13:08] typically Ethereum would be the hardest to snatch because once you're on the inside and you get an automatic signing a proposal that's running, there's nothing stopping you from on the inside getting Bitcoin out or getting Tron out
[13:24] Ethereum was actually the unique one because it required really what I call a fishnet. Uh, a lot of other people were calling this, you know, more technically a sweep of the numbers. Uh but here's uh uh basically how this worked or a spray
[13:40] of the numbers. Basically, think about Ethereum via this 7702 protocol as requiring a checkbook number. And even if you have the signing authority to make a transaction, it has to perfectly match with an authorization number like
[13:56] checkbook number 100001. And uh other protocols only allow you to do this once. So, you do one checkbook number and the signing authority, and if you get that wrong, the transaction doesn't go through. Uh,
[14:11] the transaction doesn't go through. Uh, Ethereum 7702 allows you to do like 50 authorizations at the same time. And so, because this is a publicly broadcasting because this is a publicly broadcasting chain, an attacker can see, oh, okay,
[14:25] we're roughly in this range, even though we're moving every second to another number. Let's just throw a fishnet out. I call it they call it a an authentication spray and try to hit 50 different uh you know checkbook numbers
[14:38] if you will and that's how they ended up hitting the very one match in one transaction where 49 failed one past got in. And the reason that matters is because if you go fail fail fail fail fail in a row, you're going to set off
[14:53] alarm bells and people are going to shut you down. You'll actually get exposed you down. You'll actually get exposed before you get any money out. So 7702 via the spray tech from the inside just made it easier to get that Ethereum out
[15:06] as well as all of the other money. Now all the other money would have been gotten anyway because they were on a laptop allegedly. All this information we have is what we're trying to piece together. This was just what was
[15:19] necessary only for the Ethereum. And so these were pretty dang sophisticated folks or they're just using chat GPDI. I I who knows, right? We don't know. But anyway, uh within about uh 12 minutes, uh alarm bells started going off. Uh you
[15:34] started having spre uh flag it at 8:32. Tree news at 8:41. These are UTC, so Tree news at 8:41. These are UTC, so that'd be 132 uh 141. Uh PEX Shield at that'd be 132 uh 141. Uh PEX Shield at uh 155 p.m. Tether froze 1.5 billion at
[15:50] uh 155 p.m. Tether froze 1.5 billion at around 9:01 between 9:01 and 9:25. So roughly 40 minutes to an hour after the attack began. And Circle took also about an hour to 40 minutes to start freezing some funds. Ripple and World Liberty
[16:05] also uh froze money. Ripple 200 million, World Liberty 27 million. But these people were pretty wise. Even though $2.5 billion ended up got getting frozen, they were able to get away and make off with quite a bit of a haul.
[16:22] Now, the question is, how did they end up getting some of the money out? Like, how did they pull this off? Uh, well, one of the ways you could do it is you could go collateralize what you stole, borrow against it, and then you get un
[16:40] uh sort of immutable tokens or coins. That's a problem. So the first thing that they did was they ended up dumping uh uni Pepe and wrapped coins for Ethereum as fast as possible. Uh the
[16:56] stolen stable coins tend to get frozen the fastest. So they wanted to get rid the fastest. So they wanted to get rid of those very very quickly. And Ethereum of those very very quickly. And Ethereum is one of the deepest markets for mixers
[17:08] and bridges. So people tend to like Ethereum because of that. uh wrap Bitcoin is also custodial so it could get frozen. A lot of these things can get frozen and so people generally try to get to Ethereum. So what they ended
[17:21] up doing is they ended up selling about 4.7 million unis swap uh tokens for Ethereum. Uh another outlet counted 7 million. Uh there are various different
[17:34] you know allocations here that have been argued. Uh pools on unis swap v2 v3 and argued. Uh pools on unis swap v2 v3 and v4 were all affected. 7.7 trillion Pepe that's about 37 to40ish million dollars were affected uh and many others but one
[17:49] the collateral mention that I suggested was on a thief ended up posting $60 million of USD tether seizable and then they borrowed $19,762
[18:03] Ethereum right before a froze its markets. So remember, uh, that was that markets. So remember, uh, that was that was like between 8:57 to 9:01 p.m. That's when they were leveraging up using stolen collateral. So the
[18:17] collateral gets stolen, but they're making off with the bag, right? The USDC and US Tether funds didn't actually get and US Tether funds didn't actually get frozen until 9:01 to about 9:25 and they
[18:32] frozen until 9:01 to about 9:25 and they leveraged it up between 857 and 9:01. So, it was like really freaking close. If they were just a little bit earlier, more of the damage. But it shows you how just every minute here turned into a
[18:46] thief dumping altcoins, which did end up minutes, but then our bots picked that limits some of the damage. Uh but the the the real issue is now they've got
[18:59] the the real issue is now they've got like $3 billion worth of coins or tokens potentially that if they start slowly trickling this out, you're going to kind of put sell quite a bit of sell pressure on chains for really, you know, the next
[19:13] on chains for really, you know, the next year or more. So, it's not the most bullish and so it does make betting on sort of a crypto rally a little harder just because some of that Bitcoin and Ethereum is still out there and as it
[19:25] just going to slowly get trickled into the market and this is why you're seeing this in my opinion selling pressure kind of hit the market a little bit more unevenly like when the hack occurred if we go
[19:40] like when the hack occurred if we go into let's see here we are at Eastern times right here. So, the hack occurred at about 4 420. Right here is when the hack occurred. We were at about 80,200. So, you get the hack that's occurred and
[19:56] uh you got all the way down to about 76. But you can see it really took hours and the news of this hack spreads really really fast. But, you know, these people are slowly trying to trickle those funds out. Let's take a look at uh Ethereum.
[20:11] Ethereum very similar pattern. Some people suggest some of these larger liquidations that are happening because of this, which is unfortunate for people who are leveraged up during the time of, you know, a hack like this. But really,
[20:24] this isn't so much a cyber security issue. This is not something that like even Crowd Strike or PaloAlto Networks or whatever could really have stopped because somebody ultimately just ended
[20:37] because somebody ultimately just ended up downloading some malicious code. Uh, and some of these malicious codes can actually look just like a normal withdrawal code. So, they can disguise themselves. This this kind of stuff gets
[20:51] is is pretty impressive what they pulled off over here. So, really, you need to separate an engineer's laptop like somebody who's using this themselves from the signing path because we don't know with certainty, but it was likely a
[21:05] human that oops dupsied here and they just cost Seafu lots lots of money. Uh just cost Seafu lots lots of money. Uh now SEFU is interesting because the idea is that SEFU is supposed to be 100% backed. I generally make the argument
[21:20] backed. I generally make the argument that SEFU is only safe if one currency that SEFU is only safe if one currency gets hacked. They argue that they have $165 billion of reserves, but they've never been audited. They only do proof
[21:33] of reserves. So, my belief is that they might have, So, my belief is that they might have, you know, let's just say $5 billion and then they got $5 billion of Bitcoin on the chain. Okay. Hey, yeah, we cover
[21:47] Bitcoin 100%. Okay. Do you also have five billion to cover a separate $5 billion hack on Ethereum? Sure. If Ethereum was the only one hacked, okay, what if both of them got hacked? Do you have a $5 billion bucket here or five
[22:01] and a $5 billion bucket here? Well, they don't disclose that. So, they purposefully don't disclose if they have a bucket independently for each to where if multiple got hacked, they'd have enough money for it. Supposedly, Safeu
[22:15] enough money for it. Supposedly, Safeu has about $1.2 billion of assets, which is obviously not $3 billion. It's not enough. So, it's going to be really interesting. They'll have a November 1st release of another, you know, proof of
[22:29] release of another, you know, proof of funds. Um, you know, um, proof of I'm in the real estate world, so they say proof of funds. Um, proof of reserves. Uh, that'll come out November 1st. You get a snapshot of that. But,
[22:42] you know, these aren't audited, so we don't really know what their financial people are going to get really spooked here, especially, you know, right before Halloween, and they're going to try to dip out of Binance ultimately.
[22:57] I mean, I'm a big believer not your keys, not your crypto. I mean, I've got Yeah, I know this this is unrelated. I mean, I I keep security keys everywhere. I'm like I try to be anal about this. I keep a security key plugged into my Duo
[23:11] over here. I try to be anal about this. If I was going to keep a bunch of crypto around, I would honestly use a lot of different This sounds This is a pain in the ASS, okay? But if I was holding crypto for the very long term, uh there
[23:25] this is I know not your keys out of crypto, but one would be ETF, right? Because then we got the securities regulation around it. We got Cypic coverage. Uh and and we got fully audited brokerages. Okay, that's the
[23:40] suit direction. That's probably the easiest. Okay, not sponsored by the or whatever. We did a little sponsorship here with Kelshi, but that doesn't here with Kelshi, but that doesn't matter compared to to this, right? Uh if
[23:53] I really was anal about the security, I would have multiple different cold storage wallets in different locations. Uh and I would divide up my cryptocurrency. So that way it's not like I've got all my money in one place.
[24:09] It's sort of like what you have to do with gold. You know, I got some in storage over there. I got some in a safety deposit box there. you know, maybe some's in Zurich, maybe some's in, I don't know, Germany, maybe some's in
[24:22] Manhattan. I don't know where you want to keep this stuff, right? But the point to keep this stuff, right? But the point is, uh, that's not an uncommon strategy. Multiple different brands of cold storage wallets, uh, multiple different
[24:37] lots. So, you're not just like going on Amazon and buying 10, and it's like, oh yeah, you know, somebody's tampered with those 10. They're all tampered, right? them from different vendors. You buy different manufacturers. So that way,
[24:50] one hack doesn't completely wipe you out. I know that's a pain in the AS. And that's exactly why I mention the ETF direction. I know. I know it doesn't
[25:02] sound like something I mean, it sounds like something an OG crypto would roll over in their grave for. I get it. But from an ease perspective, hey, it's an option and it still creates some buying pressure in the in the market. So, it's
[25:16] a win for everybody in crypto. Any that's my take. That's what happened here. This is fully insane. If you like that video, check this one out. I think >> Why not advertise these things that you told us here? I feel like nobody else
[25:30] see how it goes. >> Congratulations, man. You have done so you. Kevin Pafra there, financial analyst and YouTuber. Meet Kevin. Always analyst and YouTuber. Meet Kevin. Always great to get your take.