David Kessler

A few updates on the Binance situation since my last post. - The Hack Binance has finally published its initial technical findings, and, as we had expected, the attack was considerably more complicated than the original explanation involving a compromised devops laptop. According to Binance, the attackers targeted multiple engineers through malicious software, including an earlier attempt involving a tampered devtool installer and a fake job interview that delivered malware. They then exploited an internal AI tool and stolen deployment credentials to gain access to Binance's wallet-signing infrastructure. On Ethereum, malicious EIP-7702 authorizations allowed the attackers to continue moving funds even after Binance had suspended normal withdrawals. It's difficult to understand why the signing controls allowed these authorizations in the first place. I am curious to know how it is possible the authorizations were not detected more quickly, and why revoking them took so long on wallets holding such gigantic amounts. Binance says it took almost four hours to fully contain the attack. It will be good to see independent reviews from competent security analysts. - Withdrawals/Deposits (after withdrawals reopened) According to figures shared by Binance co-CEO Richard Teng and reported by CoinDesk, approximately $10.97 billion was withdrawn during the first 46 hours after withdrawals reopened, against $5.69 billion in deposits. That leaves approximately $5.28 billion in net outflows, as of early November 3. Withdrawal activity was particularly intense on Sunday, but appears to have slowed down since. Binance claims that hourly deposits had started exceeding withdrawals by the end of that period. - The Money Binance reported approximately $2.85 billion frozen or intercepted in its November 3 update. Once again, remember that frozen funds are NOT necessarily recovered funds. Binance also says it has replaced the vast majority of affected assets using its own resources, including SAFU and insurance funds (see my previous update for considerations about this). The published replenishment percentages have been somewhat inconsistent, however. And once again, replacing stolen assets is NOT the same as recovering them from the attackers. Using SAFU and the Futures Insurance Fund to cover these losses also means that the risk profile of holding funds on the exchange may have shifted considerably. As exchanges operate largely within black boxes, it is difficult to assess this at this point. - Withdrawals and Proof of Reserves Binance has published a cryptographic Proof of Reserves for ten selected assets (including Dogecoin), based on its October 31 snapshot. That is considerably fewer than the 55 assets covered in its previous snapshot, with many smaller assets still missing. Once again, this is useful, but as I have explained multiple times, Proof of Reserves are never a comprehensive audit of an exchange's financial condition and stability. More cryptocurrency withdrawals are being restored in phases, although availability still depends on the specific asset and network. Native Dogecoin withdrawals were included in the first reopening phase. The usual reminder: please make sure you select the actual Dogecoin network when withdrawing to your own wallet, rather than stuff like Binance-pegged DOGE on BSC. My recommendation stays the same: withdraw when and if you can, without rushing, and after verifying that you have good backups of your wallets and that the wallet you are using is safe.