CZ Slams Binance Hack Security Failures in $6.4B Heist

The attack began on 29 October and moved fast. Unauthorized outflows started around 20:05 UTC. Within about 20 minutes, funds drained across roughly 10 blockchains.

CZ Blasts the Security Failures Behind the Breach

CZ posted his comment at 05:09 UTC on 4 November. He wrote as a shareholder, not as an operator. CZ stepped back as CEO years ago, and co-CEOs Richard Teng and Yi He now run the company.

A hack of this scale means serious security failures occurred. No platform is unhackable, but that cannot be an excuse. Some details are embarrassing.

According to CZ, public explanations also simplified what happened. He described a prolonged attack that ran for months, even years. It targeted hundreds of employees and systems, and the attackers eventually got through to a few.

CZ also demanded accountability. He said he expects Binance to stay transparent, take responsibility, and make real improvements. His follow-up was blunt: “Trust me, I am more annoyed than anyone else.”

How the Binance Hack Actually Unfolded

This was not a smart-contract bug. It was also not a theft of cold-storage keys. Instead, the attackers spent months working their way inside.

The campaign reportedly started in June 2026. First, a tampered installer for an AI coding tool reached an engineer through a supply-chain trick. Then, in September, a fake job interview planted malware on a work laptop.

From there, the attackers pivoted. They used a compromised internal AI tool to reach more engineers. Next, they stole deployment credentials and reached an internal wallet signing service.

That signing service was the real prize. It could produce valid signatures for hot-wallet transfers, outside the normal withdrawal controls. According to Binance, there is no evidence of any wallet private-key leak.

The EIP-7702 Trick That Drained Ethereum

The CZ Binance hack response also drew attention to the technical failures behind the breach. On Ethereum, the attackers used a 2025 feature called EIP-7702. It lets a normal wallet delegate code execution. They pre-signed 50 authorizations so one would match the live nonce.

That delegation installed attacker-controlled sweeper code on Binance 14, a main hot wallet. The sweeper then emptied the balance in one transaction. On-chain data shows roughly 167,464 ETH leaving at once, visible on Etherscan.

Containment proved hard. Binance uses MPC signing, which splits key control across parties. That design slowed quick revocation while the sweeper ran.

Other chains fell in the same window. The attackers moved 233 million XRP, 18,270 BTC, plus SOL, TRON, and more. Arkham and Etherscan now tag the wallets as the Binance exploiter.

North Korea Linked to the Binance Hack

The CZ Binance hack response followed the FBI’s attribution of the theft to North Korea on 31 October. Investigators named TraderTraitor, a group tied to the Lazarus cluster. The alert listed hundreds of attacker addresses.

TRM Labs and Chainalysis reached the same conclusion independently. Both cited Tornado Cash funding, pre-staging, and fund mixing with an earlier Bitget exploit. TRM Labs pegged the loss at about $6.36 billion.

Binance had flagged this threat before. The company says it blocked 57 suspected North Korea-linked attempts during 2026. This time, the attackers got through.

User Funds Covered as Binance Freezes $2.85B

Binance moved quickly to contain the damage. The company says user funds are safe and that it will cover the full impact. By 3 November, Binance reported reserves roughly 98 percent replenished. The CZ Binance hack response also called for transparency, accountability and meaningful security improvements.

Stablecoin issuers also helped freeze the stolen assets. Tether and Circle froze large USDT and USDC balances. In total, about $2.85 billion now sits frozen or intercepted.

Still, roughly $3 billion remains loose, mostly in ETH and BTC. Those assets sit beyond the reach of issuer freezes. Analysts say the attackers are already laundering part of it.

The market felt the shock too. BNB dropped as much as 8 percent around the Binance hack, sliding from about $745 toward $680. By early November, it traded near $690.

What the Binance Hack Means for Crypto Security

The CZ Binance hack response framed the breach as a warning for the whole industry. He pointed to attackers now weaponizing AI tools. According to CoinDesk, he expects more AI-driven hacks ahead.

He also called for an industry-wide security alliance. The proposal would let rivals share hard lessons and avoid similar failures. The Block reported the proposal this week.

For users, the immediate pain looks limited, since Binance is covering the loss. The bigger question is trust. The exchange now owes a fuller account of exactly what failed.

None of this is financial advice. Prices stay volatile after events like this, so treat any trade with care. Watch Binance’s next Proof of Reserves update and the promised third-party review.