Hackers Took $6.3 Billion From Binance

Hey Lantern Community,

The biggest crypto theft in history happened last Thursday. Hackers pulled $6.3 billion out of Binance's hot wallets, and it started with a fake job interview. At the end, a faster way to pay off your loan.

Let's get into it.

Security

$6.3 billion gone, and it started with a job interview

At 20:05 UTC on October 29, Binance hot wallets on 10 blockchains started sending funds to one attacker. Binance puts the damage at about $6.34 billion, roughly four times the $1.5 billion Bybit hack. The FBI says North Korea was behind it.

Binance published its first incident report this week. The attackers got in through its employees:

• June: A wallet engineer searched online for a popular AI coding tool and installed a tampered download. Binance caught it and replaced his laptop, but the attackers now knew who ran the wallet systems.

• September: A second engineer was approached on a real job site by a fake "Project Director." After a video interview with a fake HR rep and a chat with a fake CEO, he was told to download a coding "assignment" onto his work computer. It carried malware his security software missed.

• October 20 to 29: From that laptop, the attackers reached two wallet engineers, took a deployment credential, and used it to sign transactions outside Binance's normal withdrawal process.

Binance says it stopped 57 suspected North Korea-linked attempts this year, using fake job interviews, fake developer tools and fake video-call apps. One got through.

Binance froze about $2.85 billion and says users won't lose anything. It had replaced 98% of the stolen assets by October 31.

The same tricks are used on everyday holders: fake support, fake recruiters, a download "to fix" or "to test" something. If anyone you didn't contact asks you to install something, stop.

Hot wallets stay online so exchanges can move funds fast, and that makes them a target. Your Lantern loan collateral sits in BitGo's insured cold storage, offline, and never touches a smart contract.

XRP

XRP couldn't be frozen. RLUSD could.

The first wallets drained were on the XRP Ledger: 233.46 million XRP, about $296 million, sent from five Binance wallets in four minutes. That XRP is still sitting in the attacker's wallet, and nobody can freeze it.

RLUSD was different. The attackers also took 88.5 million RLUSD, and Ripple froze 40.5 million of it about two hours in. The other roughly 48 million had already been swapped away.

Markets

Bitcoin ETFs had their worst day since June

Spot Bitcoin ETFs lost $643.3 million on Friday, October 30, their biggest one-day outflow since June 25. Another $398.6 million left on Monday, almost all of it from BlackRock's IBIT. That's more than $1 billion out in two sessions.

Then came election night. Democrats won control of both the House and the Senate, and Bitcoin dropped to $75,618 on Tuesday, its lowest since September 16. By Wednesday morning it was back above $78,000.

Lantern Spotlight

Instant payments, verified support calls and 2FA

1. Pay down your loan in minutes with Instant Payment. Turn on instant payments when you pay on the web app, then approve the request in your bank's app within 15 minutes. Most major US banks support it. Read more here: https://lantern.finance/blog/faster-loan-payoffs-with-instant-payments

2. Turn on 2FA in your settings. If you haven't yet, set up two-factor authentication in your Lantern account settings. Keep the setup key to yourself, never share your screen with anyone who contacts you about your account, and remember we'll never ask for your 2FA code.

3. Know it's really us on the phone. When you're on a call with Lantern support, your dashboard now shows that you're speaking with us. If someone calls claiming to be Lantern and your dashboard doesn't show it, hang up and text us.

Need help with any of these? Text us at (415) 365-0100.

A record hack, heavy ETF selling and a change of control in Congress all landed in one week. If you'd rather not sell into a nervous market, you can borrow against what you hold instead.

Borrow, trade and manage your crypto on one platform, with loans from 8%, 0% liquidation fees, and 72 hours to respond to a margin call.

Borrow against your crypto here: https://lantern.finance/borrow

Until next week,

The Lantern Team

This newsletter is for educational purposes only and does not constitute financial advice. Always consult with your financial advisor before making lending decisions.