Binance Theft | The Hackers Propping Up Kim's Failed State
Nov 4, 2026 · 15 min · 9 segments
**Ways to support the podcast:** Buy Me a Coffee: ☕ buymeacoffee.com/philipthompson Donate via PayPal: 💸…
- Speakers
Philip ThompsonHost
Nov 4, 2026 · 15 min · 9 segments
**Ways to support the podcast:** Buy Me a Coffee: ☕ buymeacoffee.com/philipthompson Donate via PayPal: 💸…
Philip ThompsonHost
Just after 8 o'clock on the evening of the 29th of October, money started draining out of Binance's online wallets.
Like every big exchange, Binance keeps most of its customers' crypto offline in what they call cold storage.
What it keeps online in what they call hot wallets is the money it needs to process withdrawals day to day.
For an exchange the size of Binance, that still adds up to billions of dollars spread across lots of different cryptocurrencies.
In the same minute, the hackers took control of one of Binance's biggest wallets outright.
Then things started to topple like dominoes with wallet after wallet emptied within minutes and a second wave hit just after 11pm.
Binance put a halt on withdrawals and released a statement saying it was aware of a potential security issue.
The question of course is, how did it happen? Binance's first explanation was that a laptop belonging to one of its engineers had been compromised.
That gave the attackers access to part of Binance's internal systems from which they could submit withdrawals that looked legitimate.
In effect, they got Binance's own security system to open the vault for them.
A day later Binance's co-CEO Richard Teng said the investigation had found additional points of breach beyond the laptop and that the attack was not the work of a lone wolf hacker.
He also revealed that the attackers had used a self-destruct mechanism that wiped their tools and their tracks behind them.
About 36 hours before the theft, the attacker's account was topped up through a mixer.
That's a service that scrambles crypto so nobody can tell where it came from.
We don't know yet how that engineer's laptop was compromised, But who everyone thinks is responsible has a clear modus operandi.
It could have been that the engineer was approached by a recruiter or someone within the crypto industry at a conference.
A relationship is struck up and ultimately the attacker sends the compromised engineer code that's laced with malware.
We'll have to wait for more details from Binance and the authorities if and when they publish a technical post-mortem.
Just after 8 o'clock on the evening of the 29th of October, money started draining out of Binance's online wallets.
Like every big exchange, Binance keeps most of its customers' crypto offline in what they call cold storage.
What it keeps online in what they call hot wallets is the money it needs to process withdrawals day to day.
For an exchange the size of Binance, that still adds up to billions of dollars spread across lots of different cryptocurrencies.
In the same minute, the hackers took control of one of Binance's biggest wallets outright.
Then things started to topple like dominoes with wallet after wallet emptied within minutes and a second wave hit just after 11pm.
Binance put a halt on withdrawals and released a statement saying it was aware of a potential security issue.
The question of course is, how did it happen? Binance's first explanation was that a laptop belonging to one of its engineers had been compromised.
That gave the attackers access to part of Binance's internal systems from which they could submit withdrawals that looked legitimate.
In effect, they got Binance's own security system to open the vault for them.
A day later Binance's co-CEO Richard Teng said the investigation had found additional points of breach beyond the laptop and that the attack was not the work of a lone wolf hacker.
He also revealed that the attackers had used a self-destruct mechanism that wiped their tools and their tracks behind them.
About 36 hours before the theft, the attacker's account was topped up through a mixer.
That's a service that scrambles crypto so nobody can tell where it came from.
We don't know yet how that engineer's laptop was compromised, But who everyone thinks is responsible has a clear modus operandi.
It could have been that the engineer was approached by a recruiter or someone within the crypto industry at a conference.
A relationship is struck up and ultimately the attacker sends the compromised engineer code that's laced with malware.
We'll have to wait for more details from Binance and the authorities if and when they publish a technical post-mortem.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.