币安运维电脑遭渗透引发数十亿美元盗案 Tether与Circle紧急冻结30亿

币安运维电脑遭渗透引发数十亿美元盗案 Tether与Circle紧急冻结30亿 这起系统性盗窃不仅暴露存放在交易所的加密资产本质只是平台借条，更凸显中心化机构随时冻结资金的权力风险，唯有依靠多重签名与离线冷钱包自托管才能真正规避单点暴雷。 视频详细复盘了币安遭遇的63亿美元巨额黑客洗劫案，披露黑客并非直接窃取底层主私钥，而是通过入侵一名DevOps工程师的笔记本电脑，渗透内部微服务并批量生成50份提现许可，最终命中实时票号卷走热钱包资产。尽管Tether与Circle紧急冻结了约30亿美元使币安净损失降至约10亿美元，且币安凭借庞大资产储备与SAFU基金承诺全额兜底，该事件依然揭示了中心化交易所将资产变为“借条”（IOU）的系统性风险。同时，稳定币发行方一键冻结资金的能力展现了中心化控制的双刃剑本质，Andrei Jikh据此呼吁普通散户警惕钓鱼诈骗与供应链篡改风险，大额资产应优先采用多重签名或官方直购的硬件钱包进行自托管。 币安遭遇历史级黑客袭击，总受影响资产规模达约 63 亿美元，涵盖 ETH、BTC、Tron 及数十种代币，Tether 与 Circle 随后火速冻结了约 30 亿美元链上涉案资产。 (0:00) 黑客并未破解金库私钥，而是入侵了一名币安 DevOps 工程师的笔记本电脑，渗透内部微服务并利用提现许可机制成功扫荡热钱包资产。 (7:03) 扣除稳定币冻结部分后，币安预计实际净损失接近 10 亿美元；前 CEO 赵长鹏承诺平台将全额承担损失，价值约 12 亿美元的 SAFU 基金理论上可提供兜底支撑。 (12:05) 稳定币发行方极速冻结 24 亿美元展现了中心化裁决能力，但也暴露了中心化机构随时能掌控用户资产的“双刃剑”风险，投资者被敦促使用多签名或官方直购硬件钱包自托管。 (15:08)

加密博主 Andrei Jikh 针对币安遭遇约 63 亿美元规模黑客袭击的事件展开剖析，指出本次事故源自内部运维工程师设备失陷而非底层私钥被盗，并严厉警告投资者警惕交易所资产借条本质与中心化权力风险。 黑客渗透路径与批量许可漏洞 (7:03) 本次安全事件的核心失陷点并非冷钱包金库主私钥，而是黑客成功入侵了一名币安 DevOps 工程师的个人电脑，以此为跳板渗透至币安内部审批微服务。攻击者并未直接获取底层私钥，而是滥用系统生成合法提现签名的能力。由于无法实时预知高频变动的提现排队单号，黑客利用以太坊的可编程性，提前准备了 50 份不同票号的提现授权许可凭证进行狂猜碰运气。链上记录显示，前 49 份申请均被合约判定无效拒绝，仅有 1 份成功命中实时单号，但该次命中随即打开了提现闸门。 在成功接管权限后，黑客对繁忙的 Binance 14 热钱包实施闪电扫荡，单笔交易卷走约 16.7 万枚以太坊（价值约 16 亿美元）、USDT 及 61 种代币，网络矿工费仅耗费 93 美分。极具战术性的是，黑客故意在热钱包内保留了 1 枚 ETH，使得内部自动化财务系统未触发休克熔断，持续归集全球新充值资金并向该钱包注资补仓，任由黑客后门脚本持续即时收割。同时，因审批系统失陷，攻击在极短时间内蔓延至其他公链，导致约 18,000 枚比特币和数亿美元波场资产被提走。业内结合钓鱼手段及去年 Bybit 开发者电脑被攻破遭窃 15 亿美元的先例，普遍怀疑幕后黑手关联朝鲜黑客组织。 平台偿付能力与资产借条本质 (12:05) 尽管整体受影响资金高达约 63 亿美元，但稳定币发行方 Tether 与 Circle 在一小时内迅速响应，紧急冻结了约 24 亿至 30 亿美元被盗资产。DeFiLlama 估算币安的实际净损失约为 10 亿美元，前首席执行官赵长鹏（CZ）表示损失可能略高，但承诺由平台全额承担。币安代管用户资产总规模约 1,440 亿美元，实际净损失占比不足 1%；其应急保障基金（SAFU）虽持有约 15,000 枚比特币（约 12 亿美元），但因部分资金受阿布扎比监管合规限制，本次赔付款项极大概率需由币安自有经营利润垫付。 事件发生后币安紧急暂停提现以做内部防御，但也引发了市场对资金安全的广泛焦虑。Andrei Jikh 指出，存放在中心化交易所的加密资产在法理与技术上并非用户真正所有，而仅属于交易所开具的借条（IOU）。币安作为巨头尚能依靠庞大资产池消化冲击，但抵御风险能力薄弱的中小型交易所极易因类似事故走向破产；他以自身早年在破产小型交易所损失超过 10 枚比特币的经历，告诫散户切勿因利息诱惑而将大额资金长期存放于交易所。 稳定币中心化冻结权与机构收割隐忧 (15:08) 稳定币巨头能够在一小时内协同冻结巨额资产，虽在本次事件中阻击了盗窃资金的外流，但在 Andrei Jikh 看来，这种不受约束的中心化干预权是一把双刃剑。既然中心化机构可以一键封停黑客的链上地址，同样意味着他们具备在任何时刻、出于任何理由冻结普通散户钱包资金的绝对技术能力，这与加密货币主打的抗审查与去中心化初衷截然相悖。 视频进一步指出，主流金融体系正在利用市场恐慌情绪，诱导散户放弃对底层加密资产私钥的直接掌控，转而购买现货 ETF 等受合规监管的衍生证券。金融机构将实际代币集中锁入中心化实体的金库之中，普通投资者获得的仅是被监管系统牢牢掌控的金融权益；这种散户持币证券化、机构巨头垄断底层现货自托管的演变态势，正在使加密资产的去中心化愿景被逐步侵蚀。 资产自托管防护与防诈骗防线 (16:08) 为抵御中心化系统风险，Andrei Jikh 建议大额资产持有者转向硬件冷钱包或多重签名（Multi-Sig）方案，但强调自托管工具同样面临严峻安全考验。目前 Ledger 与 Coldcard Q 等硬件设备均曾面临供应链篡改或安全漏洞挑战，因此用户必须仅从制造商官网采购，严禁通过亚马逊、eBay 等第三方平台购买或使用二手设备。若因交易需要必须留存资金，应分散存放于多家合规平台，并强制配置物理安全密钥（如 YubiKey）或独立身份验证器，坚决弃用易被 SIM 卡劫持的短信验证。 重大安全事件后往往伴随密集的二次诈骗。骗子常伪装成官方客服私信发送虚假理赔表格，或向用户钱包空投带有相似伪造地址的垃圾代币以诱骗复制。用户应建立提现白名单并逐字核对地址，牢记正规机构绝不会主动私信协助追讨资产。对于冷存储设备，助记词应使用防火防水的钛合金或不锈钢金属板保存，并加配第 25 个独立密码（Passphrase），以规避物理介质损坏与单点泄露风险。 币安被盗案暴露出单点运维权限足以威胁数十亿美元资金的架构软肋。随着机构化与托管中心化趋势加强，投资者在依赖平台赔付能力的同时，更需警惕稳定币一键冻结机制与硬件钱包供应链风险，在资产自主掌控与技术防护门槛之间寻求平衡。

[10:00] Andrei Jikh: A single engineer, compromised or not, should not be able to put $6 billion at risk. [12:05] Andrei Jikh: When you keep crypto on an exchange, you don't actually own that crypto. Remember, you own an IOU. [16:08] Andrei Jikh: Always remember, no one legitimate will ever message you to help you recover your money. [12:05] Andrei Jikh: I've lost over 10 Bitcoin on a smaller exchange that went bankrupt. So that was a learning lesson to never keep money on an exchange no matter how much they entice you with interest.

[0:00] So Bitcoin is crashing because we just experienced the biggest heist in crypto's history. And I wanted to put this out as an emergency video because this is not just finance. This is happening to supply chains of hardware wallets across the whole industry. Coins like Ethereum, Bitcoin, Tron and dozens of different tokens were stolen from Binance. By the time anyone could react, billions were gone and Binance now says the total impact is around $6.3 billion. A security incident impacting billions of dollars of funds has hit the world's largest crypto exchange, Binance, triggering emergency asset freezes and shop losses in the price of digital tokens. Overall, very bad for the crypto industry. And as a result of this, of course, Binance has frozen all withdrawals pending investigation. There's a lot of questions of customers who say their life savings are on these exchanges. And Tether and Circle have also frozen about $3 billion of the stolen money, which is good news. That also leaves a lot of questions, like whether our money is safe on these exchanges at all, and was this possibly an inside job? There's even rumors that it could have been a nation state, like North Korea, or maybe it was the work of some agentic AI, and that this is all just the beginning. This is coming to a lot of other exchanges as well. So there's a lot to go through. So in this video, I want to walk you through exactly what we know happened and how you might want to protect yourself going forward. Because in this new age of technology, I think anything that can be hacked will probably be hacked at some point or another. So with that said, let's get into it. Hi, my name is Andre Jick. Hope you're doing well. a yearly reminder to never keep your crypto on exchanges. So the reason I wanted to make this video, besides explaining what's happening, is to hopefully help you understand how to think about security in the future. So the first thing we need to understand is how an exchange like Binance actually holds our money. See, exchanges keep most of their crypto in what's called a cold storage wallet. think of it like a bank vault it's offline and it's very hard to break into but because they're an exchange they also need money on hand to process everyone's withdrawals and that needs to work instantly which is also why they keep some of it in what's called a hot wallet. Now, a hot wallet is more like a cash register. It's connected to the Internet, and money is going in and out of it constantly. In this instance, that wallet that was attacked was called Binance 14. Apparently, it's one of Binance's most busiest wallets because it's processed something like 31 million transactions. Now, here's how the heist works. Tornado Cash Tornado cash is what's called a mixer. A mixer is where you put crypto in and it comes out the other side with no trail back to where it came from. It's kind of like taking a deck of cards and then shuffling it in all sorts of crazy ways, thus losing the playing card. It's basically the crypto equivalent of paying in cash that's untraceable. Typically, no legitimate exchange funds its wallets in this way. So that was kind of like the first red flag. Now that same wallet also built a tool to designed to empty a wallet of everything it holds in one sweep. So think of it as kind of like a robot. In fact, after they built it, the attacker did a test run using this technique. They set up a few wallets of their own and they practiced it and it actually worked. Now this is where it gets kind of technical, but here it goes. Every time Binance 14, that wallet sends money out, it takes a ticket number. Kind of like how it says, now serving number 47 when you're at the DMV, right? It is constantly serving new customers. So that number is always changing. Now, Ethereum is because it's programmable money, has a feature that lets a wallet give its control over to a program, like a permission slip that says, let this robot run my counter. Now that slip only works if two things are true. It has to be signed by Binance and it has to be printed with the exact ticket number being served at that exact moment in time. Now, the attacker somehow managed to get Binance's signature on these permission slips. But because they couldn't know ahead of time which number would come up, they brought 50 different slips. [5:00] all with different numbers. Now, 49 of those got rejected, but one of them was a match. And with that one match, the robot was running the cash register. That's how they were able to sweep Binance 14 and take about 167,000 Ethereum, worth about $1.6 billion in Tether and 61 other tokens, all in just one transaction that was in total worth roughly $2.5 billion. At the low, low cost, by the way, of just 93 cents. Now, moments later, the Internet started to notice that something was off. An on-chain analyst spotted this and he posted about it. But the attacker was already moving the coins. See, by that point, they had already moved about 195,000 Ethereum to a brand new wallet. Then another Binance wallet sent $780 million in USDC to the attacker again within the hour. Tether locked up the stolen USDT, Circle locked up the USDC, and about $2.4 billion was frozen. It was at that point when CZ posted that it looked like a hack and that user funds were safe. Binance then issued a statement saying it's investigating a potential security issue, still not confirming a hack. The hack did not stop there. In fact, the attacker did something... Very interesting. It allowed them to continue stealing as this was developing. See, When the robot emptied the wallet, it didn't take everything. It left exactly one ETH behind, which was just enough for the wallet to keep working so that when new money was deposited, The wallet was instantly swept. Because it stayed open, Binance's automated systems kept doing what they always do. which is collecting customer deposits and refilling the hot wallet. So that is, in a nutshell, the technical version of what happened. Now, the obvious question is, Hold on. How exactly did the attacker get Binance to sign those slips in the first place? And was that possibly an inside job? So governments everywhere are paying more to borrow, but so are you. And unlike a government, you can't print the difference. The rate you get on a mortgage, a car, and pretty much everything comes down to your credit, which brings me to the sponsor of today's video, Kickoff. When my parents moved us to the U.S., I didn't know anyone, I didn't speak English, and we had zero credit history, and that's the catch-22 nobody talks about, which is that you need credit to get credit. Kickoff is a credit-building tool designed for exactly that problem. There's no credit check to apply, no interest, and no hidden fees, and you can sign up in a few minutes. You pick one of their monthly plans, which start at just $5 a month. You make your payment on time, which is easy with auto pay, and Kickoff reports those on-time payments to all three credit bureaus. It's designed around two key factors in your credit, payment history and utilization. And to be clear, this is a line that exists only to build credit, not for spending money elsewhere. Kickoff users with credit under 600 who made on-time payments increased their credit by an average of 25 points in just their first month and up to 86 points after their first year. And it's the number one credit building app on the App Store. And better credit generally means you pay less interest, and that's money that stays in your pocket instead of the bank's. So if your credit is holding you back, Kickoff is giving my audience 80% off your first month, which works out as low as $1. kickoff.com forward slash Andre. Thank you to kickoff for sponsoring this segment. And now let's get back to it. So here's how the attacker was able to get those slips signed. Now going into this at first, There were only three ways it could have happened. The first way is that someone stole Binance's private key, which is basically the master password to their wallet. Possible. The second way is that someone tricked Binance's system into signing something that they shouldn't have. Or the third way, it was an inside job and someone helped the attacker. But how this actually happened, according to Binance's initial investigation that they just released, is that a DevOps engineer's laptop was compromised. And this is basically one of the people who maintains Binance's internal systems. And from his laptop, the attacker got into one of Binance's internal services and then used it to submit unauthorized withdrawal transactions. So the attacker never really stole the keys to the vault. They just got inside the system that used the keys. which I think is exactly what those 50 permission slips were all about because If they had Binance's master key, they would not need to use up all those 50 guests. [10:00] You would just look at the number being served, you would sign the perfect slip, and then you'd be done. But if you get inside Binance's system, getting it to sign things for you, then you'd have to grab them ahead of time and hope one of them works. And because all of this happens on a public blockchain, every one of those 50 slips is just sitting there for us to look at right now, which is why. 49 of them are marked invalid, and only one of them is marked success. And that is all it took. It also actually explains why around 18,000 Bitcoin and hundreds of millions of dollars on the Tron network also left Binance's wallets during this window too. Because the permission slip trick I just explained, it does not work on Bitcoin or Tron. But once they were inside the system that approved the withdrawals, they were not limited to just one cash register. They could do it for multiple blockchains. Okay. Now, what Binance has not told us yet is how that laptop got compromised in the first place. And that's where the North Korea rumors come in. Compromising an employee's computer through malware or a phishing link or even a fake job interview is exactly what North Korea has done in the past. It is almost exactly what happened with Bybit last year. The hackers did not steal Bybit's keys either. They compromised a developer's machine at the wallet software company that Bybit used so that when their team signed what looked like a normal transfer, they were actually giving up $1.5 billion. In fact, the FBI attributed that attack to North Korea. Ironically, just two days before this attack happened, Binance said its security team blocked several North Korea-linked cyber attacks. Now, as of right now, this is all speculation because nobody's officially attributed this to anyone. But, But I think either way, this raises a much bigger question. A single engineer, compromised or not, should not be able to put $6 billion at risk. How is it that one laptop was able to do this much damage? Binance says it'll publish a full technical breakdown once the investigation is complete. But either way, all of this really brings me to the most important question in this video, which is, Is our money even safe in crypto anymore? So the good news about all of this is that if you have money on Binance right now, you're probably going to be okay. Because even though over $6 billion left Binance's wallets, about $3 billion of that was already frozen, thanks mostly to Tether and Circle. And the founder of something called DeFi Llama, which tracks all of this, estimates that the real loss is probably going to be closer to about a billion dollars, which CZ actually the loss might be slightly higher, but that it will be fully covered, which is great news. By the way, to put a billion dollars in perspective, Binance holds roughly $144 billion in customer assets. So even a billion dollar loss is way under 1% for them, which hurts, but it's not going to break them. In fact, Binance also has an emergency fund for events like this one. We used it back in 2019 when hackers stole about 7,000 Bitcoin and Binance covered the whole thing. Today, that fund holds roughly 15,000 Bitcoin. roughly about $1.2 billion. So on paper, about the same size as this loss. There's only a couple caveats though that you should know about. Part of that fund is reportedly being held as required capital for regulators in Abu Dhabi. So not all of it might be free to use, and Binance's promise to top the fund back up only applies if it drops because Bitcoin's price falls, not because they had to pay out a hack. So realistically, if Binance does cover this, which I think they will, it's probably going to come out of their own pocket, not just the emergency fund, but either way, user funds should be safe. Now, in the meantime, Binance has paused withdrawals on several networks as a precaution while they investigate, which is totally understandable. But if you're someone who's trying to get your money out right now and you can't, that is scary. And that brings me to the point of this whole video. When you keep crypto on an exchange, You don't actually own that crypto. Remember, you own an IOU. You own a promise from that exchange that they will give it back when you ask. Now, thankfully, Binance is big enough to cover the loss, but a smaller exchange might not be able to. And I say this because I've lost over 10 Bitcoin on a smaller exchange that went bankrupt. So that was [15:00] learning lesson to a never keep money on an exchange no matter how much they entice you with interest. Now, There's also one more element to the story that I think people are kind of missing. Everyone is celebrating the fact that Tether and Circle froze $2.4 billion in under an hour. And in this case... That's a good thing, right? But what that also means, is that those companies behind these stablecoins can also freeze billions of dollars almost instantly whenever they decide to. Now, luckily for now, that power was used against a thief. but That same button works on everyone. And that's something you have to be careful of. So the question is, how do you actually protect yourself? It's crazy because about a year ago, I made a video where I said, I thought they would be coming for our Bitcoin. Now, I think the goal is to centralize as much of it as possible into the hands of the central planners and put our money into their securities instead. They would love us to buy the ETF versions of Bitcoin so they can hold it and promise us protection. I also said that we'd most likely see more and more attacks and they would give us more incentives to hold their products. And while they incentivize us to move our money into their ecosystems, they would want to self-custody their coins for themselves. And we're seeing all of this play out with fear, uncertainty, and doubt in the meantime. So the question is, how do you actually protect yourself? And here's how I do it. If you have a sizable amount of crypto at this point, the only thing I really trust is what's called a multi-sig solution wallet. Now, I'm not going to go into the technical details here. If you're interested, I'm sure I'll have a video of that explaining it soon in the premium member section. something. Your money does not need to be on an exchange. Move it to a wallet where you hold the keys, like a hardware wallet. Now, unfortunately, nowadays, even that is risky. There was an incident with a wallet called Cold Card Q. There are also reports of ledger wallets being drained because of supply chain attacks. There is now so much money in crypto. We are seeing extremely sophisticated attacks on our money. So if you do buy a hardware wallet, please buy it directly from the manufacturer. Never buy a used wallet, obviously, but never buy from a random seller or an Amazon or eBay. keep money on exchanges and I know a lot of people do and I understand that for trading please only keep what you're actively using and spread it out don't put everything on one exchange no matter how big that exchange is And also turn on every security feature that they offer, including two-factor authentication with an authenticator app or a physical security key, not text messages, please. And while you're at it, you can also withdraw whitelist addresses so your crypto can only be sent to the addresses that you've approved. Now, this is just me personally. But I also do not trust DeFi or decentralized exchanges because they're safe until they're not. And then we get some headlines saying, AI broke the website and drained all the wallets somehow. So in the meantime, please be very careful in the next few days because – Scammers love these kinds of events. After every major hack, there's an influx of fake support messages and fake compensation forms. Always remember, no one legitimate will ever message you to help you recover your money. And also never copy a wallet address from your transaction history because scammers are actively sending fake tokens from lookalike addresses, hoping that you'll copy the wrong one by mistake. And lastly, also understand what you're holding. Stable coins like USDT and USDC are also IOUs. And as we just saw, they can be frozen too. Now, in this case, they predicted Binance, but it's worth knowing that this same feature applies to everyone. Now, to be fair, self-custody is not risk-free either. If you lose your recovery phrase, no one can help you get it back. So please make backups on things like those titanium plates and steel plates, and also add those 25th word passphrases to make it extra secure. I'm sure I will make videos about this in the future in the premium member section, but if you're interested, all of that will be down there. I post my extra thoughts, and I also post a day early. sponsors and make more videos like this. If that's useful to you, the link is down below. Thank you so much for watching. I'd love to see you back here next week. Stay safe and I'll see you soon. Bye-bye.