Worked example · 2019-05

Binance hot-wallet compromise — Bitcoin — 2019-05-07

Loss

7,000 BTC (about $40M at the time) withdrawn from Binance's Bitcoin hot wallet in a single transaction (Decrypt). Binance said cold storage was not accessed and that it would cover the loss from its SAFU fund.

OAK Techniques observed

OAK-T11.001 (Third-Party Signing Vendor Compromise — broadly construed; Binance's own withdrawal-authorisation path was the failure surface). OAK-T15.003 (Operator Endpoint / Infrastructure Compromise — Binance said attackers used phishing, viruses and other attacks and obtained user API keys and 2FA codes; the exact entry point was not disclosed). OAK-T7.001 (Mixer-Routed Hop — retained from the earlier draft; none of the sources cited here describes the laundering path).

Attribution

unattributed. No government, court or forensic-firm attribution was found; an earlier draft linked the theft to OAK-G01 (Lazarus) and cited a 2020 UN report, neither of which is supported by the sources cited here. Link removed 2026-10-11.

Corrected 2026-10-11

removed the unsourced UN-panel attribution, the claims of employee spear-phishing and multi-signature hot-wallet design, the "mixer / coinjoin laundering", "~08:00" timing, the SAFU "10% of trading fees" detail and the campaign list; the sourced mechanism is phishing / viruses yielding API keys and 2FA codes used through "multiple seemingly independent accounts" to make one 7,000 BTC withdrawal.

Key teaching point

The 2019 Binance incident is an early exchange-sized hot-wallet theft where the attack went through account and API credentials plus the withdrawal-validation path rather than a drained cold store. Binance's response was to close deposits and withdrawals for a security review and to announce changes to API, 2FA and withdrawal-validation areas (Changpeng Zhao, as reported), while an exchange-run insurance fund (SAFU) covered the loss.