Binance Lost $6.3 Billion to Its Own Signing Machine

On Thursday, October 29, Binance suffered a massive hack, losing $6.3 billion across ten blockchains. The exchange claimed no wallet private keys were compromised, as each transfer was validly signed. Binance holds customer assets in cold storage and hot wallets, the latter signing transactions automatically. The hot-wallet signer is designed to be an obedient machine, with the key stored in a hardware security module or multi-party computation setup to prevent theft.

Binance's first explanation suggested a compromised DevOps engineer's laptop, but the story evolved as more intrusion points were discovered. Co-CEO Richard Teng reported additional intrusion points and the attacker using a self-destruct mechanism to erase traces. The company is now reviewing its endpoints, cloud systems, key management, and signing processes across the entire organization, though the specific method of the laptop's compromise remains undisclosed.

This attack surpassed the previous record set by Bybit, which lost over $1.5 billion approximately 20 months prior. TRM Labs, a blockchain security firm, estimated the total loss at $6.36 billion, most of which was transferred within 20 minutes. The attack on Ethereum, Bitcoin, Tron, Optimism, and five other chains demonstrated how blockchain systems accept any transfer with a valid signature, regardless of whether it came from the rightful owner or an attacker.