How Hackers Drained $6.3B From Binance

The episode opens with what it calls the biggest cyber-heist in history: hackers drained $6.3 billion from Binance’s digital wallets after breaking into a Binance engineer’s laptop, among other breaches. Tether, Circle, and other crypto firms froze about $3 billion, leaving approximately $3.3 billion under the attackers’ control. Researchers attributed the attack to North Korea’s TraderTraitor group. The theft shook the wider crypto market and pushed down Bitcoin, reducing the value of Binance’s emergency Secure Asset Fund for Users, or SAFU. SAFU held $1.23 billion on Thursday, but its Bitcoin-denominated value fell by roughly $100 million after the market reaction. Binance said it would cover affected customers through SAFU and company reserves. The exchange had already reserved more than $6.3 billion, including SAFU, although about $5 billion was held in the same cryptocurrencies the hackers stole. Binance said it was buying the remaining $1.3 billion through market channels, a process that could take longer. The exchange temporarily blocked withdrawals while conducting security checks and said service should resume within two days. Binance’s U.S. sister exchange, Binance.US, said it was unaffected. The scale of the loss was described as severe but manageable relative to Binance’s balance sheet. Nansen estimated that $167 billion in crypto assets sat across Binance-controlled wallets, including user funds, company assets, and SAFU. Founder Changpeng Zhao called the remaining shortfall painful but manageable, while Moody’s executive Christiano Varetcelli said the incident demonstrated the risk of concentrating enormous assets in a centralized intermediary. The attack also triggered a public discussion about Binance’s ability to pay and an online confrontation involving Zhao and Elon Musk.

The technical account focuses on Ethereum’s EIP-7702, a feature intended to make ordinary wallets more capable. Normally, a wallet is controlled by a private key and cannot enforce rules such as spending limits or approved-recipient lists. EIP-7702 lets a wallet sign an authorization pointing to a smart contract; once accepted, the wallet can execute that contract’s code. The authorization remains active until it is replaced or canceled. The feature was designed for uses such as batching payments or letting another party pay transaction fees. Wintermute found that many EIP-7702 delegations instead pointed to copy-pasted “sweeper” scripts. Those scripts automatically forward a wallet’s funds to a thief once the wallet’s key has been compromised. In Thursday’s attack, the attacker deployed a sweeper contract that only the attacker’s wallet could operate, then prepared 50 authorizations for Binance wallet “Binance 14.” Each authorization covered a consecutive transaction-counter value, from nonce 18,914,775 through 18,914,824. Because Binance 14 was processing many withdrawals, its nonce kept changing. The network ultimately accepted authorization 18,914,809 and ignored the other 49; five transactions earlier in that Ethereum block, Binance 14 had used nonce 18,914,808. The accepted authorization allowed the attacker’s code to run through the Binance-controlled wallet. CoinDesk’s reconstruction concluded that the 50 valid signatures gave the attacker repeated opportunities to land the malicious transaction while the wallet continued operating. The Ethereum transactions explain one part of a much larger theft: the attacker also moved 18,270 Bitcoin, hundreds of millions of dollars in XRP, and assets on Solana, Tron, and other networks through ordinary signed transfers. Those chains do not use EIP-7702, so the common factor was the presence of valid signatures from Binance-controlled wallets.

Binance co-CEO Richard Teng said preliminary findings pointed to a compromised DevOps engineer’s laptop. The compromise may have let the attacker access a service container and submit unauthorized withdrawals. Teng emphasized that this was not simply one engineer’s permissions being used and not a one-click attack; he described a more complex process. The investigation had not assigned responsibility to an individual and had found no evidence that wallet private keys themselves leaked. The attacker’s preparation began with small withdrawals from the Tornado Cash mixing service, according to a reconstruction of the network. On Thursday afternoon UTC, the attacker rehearsed the operation on wallets they controlled before deploying the sweeper contract. The broad theft therefore involved both the EIP-7702 authorization against Binance 14 and conventional signed transfers across several other blockchains. The episode presents the incident as a security and concentration problem rather than merely a single vulnerable feature. Moody’s Christiano Varetcelli said stronger institutional controls could reduce some vulnerabilities, but the amount of property held by a centralized intermediary magnifies the consequences of a successful breach. Binance said that after its hot wallets were replenished with company reserves, users’ cryptocurrency balances would remain unchanged. Its spokesman said, “We will weather this storm,” while the company worked to restore withdrawals and replace the stolen assets.

Amazon shares opened down 4.4% to $233.10 after the company reported heavier-than-expected capital spending and the slowest growth in its core e-commerce business in three years. Third-quarter sales rose 12% to $201.9 billion, slightly below expectations. Amazon spent more than $77 billion on property and equipment in the quarter, largely as it builds data centers and expands its ability to meet demand for artificial-intelligence services. The company maintained its forecast of $220 billion in 2026 capital expenditures, after raising that outlook in July because a memory-chip shortage was constraining supply. CEO Andy Jassy said spending would rise meaningfully again in 2027. The retail figures were weaker: online sales increased only 2% to $68.5 billion, the lowest increase since early 2023, and advertising sales rose 11%, their slowest reported rate since Amazon began breaking out advertising in 2020. Analyst John Tomlinson suggested that moving Prime Day from July to June contributed to the retail weakness, but still said, “There’s a bit of a crack in the armor here.” Over the trailing 12 months, Amazon reported a $42.4 billion free-cash outflow. AWS revenue accelerated for the sixth consecutive quarter, helped by customers such as OpenAI and Anthropic. Jassy said AWS’s strength extended beyond AI: its core computing and storage businesses grew at their fastest rates in several years. The host questioned what all the spending was ultimately producing, noting that Amazon is not usually discussed as a leading model provider, even though it is investing heavily in the infrastructure used by AI companies.

Spotify is considering launching an AI product in the first quarter of 2027, potentially unveiling it around the Grammy Awards in February. According to the Financial Times report cited in the episode, the feature could cost paying subscribers an additional $4 to $5 per month. It would let users create new versions of popular songs, such as turning a folk song into a dance track or making one artist appear to cover another artist’s music. Timing and pricing were not final, and Spotify declined to comment. The product depends on licensing negotiations. Spotify had already reached agreements with Universal Music Group, the independent-label licensing group Merlin, and French music company Believe, while it was still negotiating with Sony Music and Warner Music. Spotify and Universal were also meeting individual artists to persuade them to make their music available. The report said established older artists appeared easier to recruit than major contemporary stars. Artists would be able to opt in or out even if their record label signed a licensing deal. Olivia Rodrigo, a Universal artist, gave a categorical rejection in an interview with the Hollywood Reporter: “I would never,” she said, adding, “Absolutely no hard line on that.” The episode frames the launch as a test of whether the music industry can turn generative AI into new revenue while addressing artists’ resistance and preserving individual control over participation.

The first long-read concerns AI’s ability to forecast extreme weather during what the episode describes as a historically strong El Niño. Scientists and businesses are watching the technology as they try to anticipate effects on food and livelihoods; potential users range from Kenyan crop farmers to hedge funds trading sugar futures. The payoff could be faster, cheaper analysis of weather patterns, especially as climate change makes extreme weather more common. The International Chamber of Commerce estimated that extreme weather and climate disasters cost the global economy more than $2 trillion from 2014 through 2023. The caution is that El Niño and climate change are intrinsically unpredictable, and AI systems are trained on past conditions that may not represent the future. Ko Barrett of the World Meteorological Organization said AI approaches were at least matching traditional modeling, but acknowledged that their training data might not capture what comes next. Liz Stephens of Reading University warned that communities could prepare only for historical extremes while missing unprecedented events or risks in places that have not previously experienced them. The second long-read visits a Southwest Virginia fairground where musicians gather each August for Galax, a six-day old-time music competition rather than a conventional festival. Contestants play one song before judges in categories including fiddle, guitar, dulcimer, and folk song. Individual prizes range from $35 to $285; a campsite and contestant pass cost $175, while the prestige of winning is considered more valuable than the money. The event once filled the grounds, with people arriving days early and sleeping in horse stables, and has attracted figures such as Elizabeth Taylor and, reportedly, musicians from Old Crow Medicine Show and Leftover Salmon. Attendance has fallen from its pre-pandemic level and from its peak. Fiddler Glenn Alexander, who has attended since childhood, said, “We are all scared to death. This is going to go away and quit,” citing possible causes including young people choosing devices, economic decline driving residents away, and an aging population.