THE BIGGEST THEFT OF ALL TIME - Honey I just lost $9 billion!!!
Less than a week ago, the biggest theft of all time occurred. Let me repeat, THE. BIGGEST. THEFT. OF. ALL. TIME!
Sorry Saddam, you’re no longer top dog.
Cute fact that had avoided my gaze. The Guinness Book of Records lists the world’s greatest bank robber ever … as Saddam Hussein.
Yep the moustachioed mofo may not have had any weapons of mass destruction, but on the eve of the invasion based on the assumption such things existed, he did instruct his son Qusay to take three massive trucks to the Baghdad Central Bank and load them up with, give or take, US$1 billion in cash.
I mean, you never know when a lazy billion might come in handy in your post-dictatorial life do you?
Well we all know how it played out for the world’s greatest bank robber Saddam H.
And his 1B take-away has been blown out of the water.
On 29 October, hackers stole approximately US$6.3 billion (A$8.9 billion). from Binance, the world’s largest cryptocurrency exchange.
No trucks, no Presidents sons, no ten-or-so tonnes of paper that you need to stash somewhere.
Just twenty minutes online and an incredible network of digital tentacles saw most of this vanish.
It is the largest cryptocurrency theft ever recorded, roughly four times the size of the previous record, set just last year. In fact it is the largest amount of anything ever stolen by the length of the Flemington straight.
And the alleged culprits?
Well on the topic of dictators, it was almost certainly, our old buddies North Korea.
So, asking for a friend, how do you steal nine billion dollars?
Crypto platforms like Binance operate hot wallets. These are digital wallets connected to the internet, allowing customers to withdraw or transfer their cryptocurrency.
Think of them as the digital equivalent of a bank’s cash drawers, with enormous amounts of money sitting within reach of the online world - kids, ask your parents. Parents, start by explaining what a bank is, and go from there.
If you open your Binance app on your phone, and send $100 of Bitcoin to your friend on another platform, Binance will take $100 of Bitcoin sitting in a hot wallet and move it along the blockchain to your buddy’s account.
To guard against potential malfeasance, a secret digital key is needed to authorise any such transaction.And given the millions of transactions occurring on Binance across any window of time, their wallets understandably hold some serious reserves.
Turns out, billions of bucks worth!
According to Binance, the hackers compromised several engineers’ computers over months, through malicious downloads and fake job interviews.
Eventually, the attackers gained access to systems capable of authorising cryptocurrency transfers.
“We should have invested more in security earlier, and set stricter standards.” — Yi He, Binance co-founder and co-CEO, video statement, 30 October (translated from Mandarin).
So what is a poor cyber-hacker expected do once they have the keys to the crypto city? They go to town.
It’s all about the prep.
Investigators at blockchain intelligence company TRM Labs discovered that preparations began at least 36 hours before the robbery.
The hackers practised on several wallets before launching their assault.
And here’s where things get particularly clever.
On Ethereum, one of the world’s biggest cryptocurrency networks, the attackers exploited a feature that allows digital wallets to hand over control to computer programs.
They prepared 50 signed authorisations, designed to ensure that at least one would work when the moment arrived.
One did.
In gaining this access, the attackers effectively turned a Binance wallet into an automated money-draining machine.
Three minutes and 24 seconds after taking control, the hackers ordered it to transfer an enormous quantity of cryptocurrency into accounts they controlled.
And whenever more funds arrived, the machine could help itself again.
Other Binance wallets were being emptied across nine additional blockchain networks.
So when it came to just under 9 billion, yes that’s billion with a ‘B’, bucks of bitcoin and other crypto vanishing, most of it was goneski in roughly twenty minutes.
Chainalysis suggests once they had grabbed the moolah, thousands of rapidly executed transactions followed, apparently using automation to make the stolen money harder to follow.
“These types of events should be impossible to happen, not improbable.” — Odysseas Lamtzidis, founder of blockchain security company Phylax Systems.
Meet TraderTraitor.
On 31 October, the FBI officially blamed a North Korean state-sponsored hacking operation known as TraderTraitor.
And our friends in Pyongyang have serious form. NK hackers were blamed for the US$1.5 billion theft from cryptocurrency exchange Bybit in February 2025.
The Hermit Kingdom, under the direction of Supreme Leader, has developed a formidable cybercrime operation, with stolen cryptocurrency providing a potential source of foreign currency for its heavily sanctioned government.
Yep these players aren’t amateurs.
So it was AI yeah? Sort of.
It is understandable in this hectic age of AI being at the centre of everything - The Hugging Face hack, the existential crisis in mathematics, serious sloppification of the web - to assume that a world’s biggest ever crypto heist, would have to have some nefarious cutting-edge AI at its centre.
Well from everything we can tell so far, for the most part that seems to NOT be the case. No evidence of swarming agents, or turbocharged hacking of software. For the most part this seems to be good old-fashioned cyber-crypto crime.
There’s no evidence AI was involved in the automation stage of the heist. Ordinary software can do all of this and has been doing so in online hauls big and small for years.
Now according to Binance’s latest analysis the attackers exploited an internal AI tool to gain access to its engineers’ systems. I mean it would be rude to leave AI out entirely.
But the recent turbo-charged AI threats you’ve read about, were not at play here. At best a small mercy if you’ve just lost $9B big ones, but a timely reminder that even before the latest wave of agentic turmoil, bad people could do seriously bad things online.
Can you get the money back?
While we think of crypto as harder to track than physical cash, and while that is sold as an attractive part of these new currencies, turns out it’s a bit more complicated than that.
In the case of this gigantic theft, literally the most of anything EVER, how much might be recovered will come down to exactly what was taken.
According to TRM, in US$ the haul splits roughly $2B of the cryptocurrencies Bitcoin and Ether, and $3B+ of the stable coins USDC and USDT. With a lazy billion or so of other loose change thrown in.
Stablecoin providers including Tether and Circle are more easily able to lock down stolen assets. Accordingly they moved rapidly to freeze billions. Binance says approximately US$2.85 billion has been frozen or intercepted.
But Bitcoin and Ethereum are considerably harder to stop, because once hackers control them, nobody can simply push a button to freeze those funds.
By 1 November, Binance reported replacing 95 per cent of the affected assets and it began to reopen withdrawals in stages.
Not surprisingly there were some pretty significant withdrawals on day 1. About the same amount as was nicked according to The Information.
Looking forward.
Surely some simple precautions could reduce the threat of these sort of crimes? While the world of crypto thrives on the idea of zero-friction, experts are suggesting this needs some caveats.
“If you’re gonna move a billion dollars, there’s a 24-hour, like, clock on that thing … You don’t just get to yeet* that thing out the door” — Austin Campbell, founder of Zero Knowledge Group and adjunct professor at NYU Stern. * ‘yeet’ young person’s talk for ‘throw, hurl, usually with force or abandon’.
And perhaps there’s a bigger lesson here.
We spend enormous amounts of time worrying about sophisticated encryption and the mathematics underpinning cryptocurrencies.
Yet the greatest vulnerability can still be the ordinary computers and software systems operated by the people entrusted with protecting them. people who make mistakes. people who get lazy.
Don’t forget, we are talking nine billion dollars here. And twenty minutes.
Kim Jong-Un, the drinks are on you my man.
Further reading.
These are the strongest sources for the published version, particularly the primary technical analysis.
Comments