Crypto With Block Daily: Binance Reopens Withdrawals

Daily rundown

Hi, I'm Block, and this is Crypto With Block Daily for Sunday, November first. The Binance hack is still the biggest story: withdrawals are reopening in phases, and the FBI has named North Korea.

Daily rundown

After that, a wave of hijacked DeFi websites, and an exploit at a staking protocol called b14g.

Here's the rundown. Binance reopens withdrawals and the FBI points to North Korea. Twelve DeFi websites were hijacked to serve a wallet drainer. And the b14g staking protocol lost about ninety-seven million CORE tokens.

Starting with Binance. On Saturday, the FBI said North Korea's TraderTraitor hacking group was behind last Thursday's theft of more than six billion dollars.

Binance and Cointelegraph put it at about six point three billion, and Chainalysis puts it near six point four billion. It is the largest crypto theft on record.

Binance's own figure is about six point three billion dollars. Chainalysis, a blockchain analytics firm, puts it near six point four billion. Chainalysis said on October thirtieth that about two point eight billion dollars had been frozen.

CoinDesk's FBI report says stablecoin issuers froze over two point four billion, and its Binance report cites roughly three billion frozen by partners. The figures vary by date and source.

Chainalysis said it tied the attack to TraderTraitor partly because stolen Binance funds mixed on-chain with money from last month's Bitget theft, which had also been attributed to North Korea.

It also described laundering that looks automated, with thousands of transactions moving funds between addresses.

The FBI said the hackers have been converting funds mostly into ether, and it expects them to use swap services and DeFi tools to keep laundering.

It asked exchanges, node operators and DeFi services to block hundreds of listed addresses. Chainalysis expects the number of addresses to grow into the tens of thousands.

What it means for you

A quick note on what this means for you. Binance says it, not its customers, is absorbing the loss, according to CoinDesk.

What it means for you

The laundering is a problem for exchanges and DeFi services, so there's nothing for you to do on that part. What does affect you is withdrawals, so let's look at those.

Binance said on Sunday that withdrawals are reopening in phases, and the first network opened is Bitcoin, according to Cointelegraph. Binance said it is prioritizing tokens based on recent user demand, and will restore each network only after stability and security checks.

Binance said it has replaced ninety percent of the stolen crypto, and that customer holdings of major coins like bitcoin, ether and USDT are fully backed, per CoinDesk.

The rest is less liquid tokens. A full cryptographic proof of reserves is expected by November third. How the attackers got in is still not fully explained.

What should you do? Binance said to check the withdrawal page for your coin and network, or its network status page, and to expect congestion and delays. If a withdrawal fails, try again after a short while. As general advice, trust only Binance's official channels.

Official channels only

Hijacked websites

That covers Binance. The second story can hit you even if you did everything right: a website you trust quietly sending you somewhere else. It's called a DNS hijack, and over the weekend it hit a dozen DeFi projects at once. Here's what's known.

Over Halloween, security firm Blockaid warned that at least twelve DeFi websites were serving a wallet drainer called Step Drainer, including Flap, Kintsu and StonkFun, according to crypto dot news. The affected teams told users not to connect wallets or sign anything.

The named sites were Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and Apex. StonkFun said it moved to new infrastructure and knew of no affected users.

Blockaid's alerts gave no victim count or loss total. The Block has since traced about one hundred thirty-eight thousand dollars in stolen funds on EVM chains, a partial figure.

It reports that all twelve domains were registered with Name dot com. The total loss is not final.

Flap said its official domain was redirected to an unauthorized site, which means even a correctly typed address could send people to the attacker's page.

Blockaid said the hijacked sites were serving the Step Drainer script. Clicking Connect Wallet could send users to a page that requests harmful token approvals or signatures.

If you connected a wallet or signed anything on one of these sites since midnight UTC on October thirty-first, Kintsu advised revoking suspicious approvals and moving assets to a fresh wallet. A tool like Revoke dot cash can show what you've approved. If you never connected a wallet or signed anything, there is no known exposure. Still, avoid these sites until each team posts an all-clear, because some networks may keep serving the malicious page for a while after a fix.

No wallet connected? No known exposure

b14g exploit

That's the hijacked sites. The third story is a staking exploit, and the useful thing is to be clear about what is and isn't affected. The details are still coming in, so I'll stick to what b14g and Core DAO have said.

b14g, a Bitcoin dual-staking protocol, said about ninety-seven million CORE tokens staked through it were withdrawn without authorization early Saturday morning Eastern time and sent to an attacker's address. It paused the affected contracts, according to TokenPost.

According to b14g, about sixty-eight million of those tokens are still on the Core chain, and exchange partners have frozen about nine million.

It hasn't explained how the exploit worked or the full user losses. Some headlines say ninety-seven million dollars, but that figure is a token count, not a confirmed dollar value.

Core DAO said the Core network itself wasn't compromised, and that CORE staked directly with validators or through other protocols is unaffected. b14g says Bitcoin staked through it remains locked on the Bitcoin network. If you staked CORE through b14g, follow only its official updates, and be wary of paid recovery offers.

b14g stakers: official updates only

Today's takeaways

That's today's rundown. If you use Binance, rely on its official channels while withdrawals come back in phases.

Today's takeaways

If you use DeFi sites, check your approvals, and wait for the project's all-clear on its official social accounts before reconnecting a wallet after an incident like this.

Today's takeaways

And if you staked CORE through b14g, wait for official updates.

Sources

• FBI attributes the Binance theft to North Korea's TraderTraitor and asks DeFi to block addresses
• Chainalysis tracing of the Binance theft to North Korea and laundering patterns
• Binance opens phase one of withdrawals, Bitcoin network first
• Blockaid flags 12 DeFi sites serving Step Drainer
• b14g loses about 97M CORE; Core DAO says the network was not compromised

Education only. Not financial advice.