The Largest Financial Cyberattack Just Happened...

Summary

The presenter reports a major Binance cryptocurrency exchange security incident, with an estimated impact of $6.3 billion. This figure is described as an early, developing estimate—not a final audited loss.

Binance reportedly said the incident may have involved a DevOps engineer’s laptop, which enabled an attacker to access a service container and submit unauthorized withdrawal transactions. Binance reportedly found no evidence that wallet private keys were leaked and said it would publish a technical postmortem after its investigation.

At the time of the video, blockchain partners had reportedly frozen roughly $3 billion in assets. CZ, described as a Binance shareholder rather than its manager, said user funds were safe and credited Tether and Circle with acting quickly. The incident was still unfolding, and the presenter cautioned that more details were expected after the weekend.

Funds and assets discussed

• A wallet identified by the address 0x8532FA reportedly held about 197,000 ETH, worth approximately $442 million at the video’s cited ETH price of $2,200. The presenter said it was one of eight accounts associated with the exploit.
• The presenter described a transfer of about $780 million from Binance hot wallet 34 to a main receiving wallet. The hot wallet was later reported to hold less than $1,000 in ETH.
• The receiving wallet was said to hold roughly $1.1 billion in USDC, close to $1 billion in USDT, and about $27.7 million in World Liberty Financial tokens. These figures were presented as observations from blockchain explorers.
• The video describes USDT (Tether) as a stablecoin intended to track $1 per token.
• Some funds were reportedly still moving, and some transactions were routed through Tornado Cash, a crypto-mixing service that can make transaction tracing more difficult. The presenter notes that blockchain transactions remain traceable, though mixing complicates attribution and tracking.

Reported freezes

The presenter gives the following asset-freeze amounts:

• Tether: $1.77 billion
• Circle: $825 million
• Ripple: $40 million
• World Liberty Financial: $27.8 million

These figures total approximately $2.66 billion, consistent with the video’s rounded estimate of about $3 billion frozen. The presenter cautions that funds not frozen could still be moved or laundered.

Attack method and attribution

• The presenter explains EIP-7702 as a mechanism that can let a regular wallet temporarily operate through smart-contract code.
• In the described attack, the operator reportedly submitted one transaction containing 50 authorizations signed by a Binance hot wallet. Preparing authorizations for different transaction counts (nonces) was said to help ensure that one remained valid when executed, enabling the attacker to direct funds to a sweeper contract.
• The presenter says TRM attributed the incident to North Korean-linked actors based on similarities to previous heists. The video does not describe this attribution as confirmed by a government announcement.
• The video connects the suspected activity to Lazarus Group and a subgroup referred to in the subtitles as “Trader Trader.” It cites past targeting of blockchain and cryptocurrency organizations through social engineering and Trojanized applications.
• Similarities cited with earlier incidents include preparatory activity before the theft, small Tornado Cash withdrawals, and signatures gathered in advance and executed in a burst. The presenter says the laundering observed so far—large swaps through market makers and lending protocols—differed from the bridge-heavy pattern after the $1.5 billion Bybit hack in February 2025.
• Kelt DAO is also mentioned as another incident with features compared to the Binance attack.

Key cautions

The presenter repeatedly frames both the loss estimate and the North Korea attribution as provisional. The video does not provide investment recommendations or an explicit “not financial advice” disclaimer.

Presenter and sources mentioned: Mutahar / SomeOrdinaryGamers; Binance; CZ; TRM; CISA; the FBI; Etherscan and other blockchain explorers; Tether; Circle; Ripple; and World Liberty Financial.