Binance lost 7,000 BTC in a sophisticated attack combining phishing, malware, and API key theft to bypass 2FA and security checks.
Hackers used a combination of phishing, malware, and viruses to obtain API keys and 2FA codes from a large number of Binance user accounts. The coordinated withdrawal of 7,000 BTC was executed in a single transaction, triggering Binance's automated risk management systems — but too late. CEO CZ announced Binance's SAFU fund would cover all losses.
The 7,000 BTC were immediately dispersed across hundreds of addresses to fragment tracking. Funds moved through Bitcoin mixers and were sold via OTC desks in small batches. Binance covered user losses from its Secure Asset Fund for Users (SAFU). The attacker's identity was never confirmed, though the sophistication suggested organized crime or state actors.
e8b406091eeac6e3758bb92d87b639cdc01c9d55207624a3fb7873a3a3d19e57