Ilya Lichtenstein, the hacker who admitted laundering $4.5 billion in stolen crypto, sat down with CNN’s Jon Sarlin this week to explain the Binance hack. His message: breaking into an exchange is only half the job, and the hard part starts afterward. CNN’s headline captured it as stolen crypto being like “holding a hot potato.”Who Is the Hacker Explaining the Binance HackWhat Happened in the Binance Hack on Oct. 29Why Lichtenstein Calls Stolen Crypto a Hot PotatoThe Two Hard Problems: Breaking In and Cashing OutStage one: getting into the exchangeStage two: laundering the proceedsFrozen Stablecoins Versus Bitcoin That Cannot Be FrozenNorth Korea and the TraderTraitor AttributionBinance’s Response: 90% Replenished, $6.34B Set AsideMarket Impact: Bitcoin, Coinbase and Robinhood ReactHow the Binance Hack Compares With Bybit and BitfinexHistorical Context: A Hacker Turned CommentatorThe AI Warning Inside the InterviewWhat the Binance Hack Means for Exchange Security TeamsFive Predictions for the Weeks AheadWhat We Still Do Not KnowFrequently Asked QuestionsWho is the notorious hacker explaining the Binance hack?How much was stolen in the Binance hack?What does the hot potato comparison mean?Who is blamed for the Binance hack?How much of the stolen money was frozen?Will Binance users get their money back?Can the stolen bitcoin be frozen?Related Coverage
The Binance hack hit on Thursday, Oct. 29, and drained roughly $6.3 billion across several blockchains in about 20 minutes, according to CNBC and NBC News. That makes it the largest crypto theft on record, about 4.2 times the size of the Bybit heist from 2025. Binance says it has already replenished 90% of the lost assets and plans to restart withdrawals today, Nov. 1.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
This analysis walks through what Lichtenstein said, what the public record shows about the attack, why frozen stablecoins and unfrozen bitcoin tell such different stories, and what the next few weeks could look like. It also flags what no outlet has confirmed yet, because the story is still moving.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Who Is the Hacker Explaining the Binance Hack
Lichtenstein carries real credentials for this conversation. He was linked to the 2016 hack of the Bitfinex exchange, and in 2023 he pleaded guilty alongside his wife, Heather Morgan, to a $4.5 billion money-laundering scheme tied to that theft. In November 2024 a US court sentenced him to five years in prison, according to the US Department of Justice. CNN reports that he was released early and now works as a white-hat hacker.
That legal status matters for how readers weigh his comments. He is a convicted launderer who served time, not an active threat actor, and he speaks about the Binance hack as an outside observer with direct experience of how stolen coins move. He has no inside knowledge of the Binance investigation, and CNN does not claim otherwise. Treat his remarks as expert commentary on the mechanics of crypto crime, not as evidence about who attacked Binance.
You may like
The interview ran as a CNN video segment and a companion written story on Oct. 31. Regional CNN affiliates syndicated the text, which is where the details of his comments come from in this piece. Our fact check below relies on that syndicated copy plus separate reporting from CNBC, NBC News, CoinDesk, and Wikipedia’s running summary of the incident.
What Happened in the Binance Hack on Oct. 29
The attack began on the afternoon of Oct. 29 and ran for about 20 minutes. Attackers pulled assets out of Binance’s hot wallets across ten blockchains, including bitcoin, ether, and the stablecoins USDT and USDC. CNBC put the total at about $6.3 billion, while CNN reports more than $6 billion. Other trackers show slightly higher totals, such as $6.36 billion, so the exact number will keep shifting as analysts finish their tallies.
Binance suspended withdrawals after the theft. The exchange then said on Oct. 31 that it had replenished 90% of the stolen assets and set aside more than $6.34 billion of company funds to make users whole, as reported by CoinDesk and Cointelegraph. The table below collects the main numbers from named outlets.
MetricFigureReported byTotal stolenAbout $6.3 billionCNBC, NBC NewsDuration of the drainAbout 20 minutesCNBC, Yahoo FinanceBlockchains affected10Wikipedia summaryFrozen on-chainRoughly $3 billionCNBCUSDC frozen by CircleMore than $800 millionCNBCUSDT frozen by TetherMore than $1.5 billion (per CEO Paolo Ardoino)CNBCBinance reimbursement set asideMore than $6.34 billionCoinDeskShare of assets replenished90%Cointelegraph, TBS News
Beyond the table, the attribution picture came together fast. Blockchain analytics firm TRM Labs pointed to North Korea-linked TraderTraitor, and our report on the TRM Labs attribution covers that analysis in detail.
Why Lichtenstein Calls Stolen Crypto a Hot Potato
The hot potato line is the center of the interview. As CNN reports it, Lichtenstein argues that anyone holding a huge pile of freshly stolen crypto cannot simply sit on it or spend it. Everyone is watching the wallets, so the thieves have to move the money fast and through channels that will not hand it back to investigators.
The mechanics behind that idea are easy to lay out. Blockchains publish every transaction. Analytics firms tag wallets within hours. Exchanges and stablecoin issuers can refuse deposits or freeze tokens once an address is flagged. A thief who holds $6 billion in traceable assets holds a ledger full of evidence and a clock that runs against him. That is analysis layered on his comments, not a claim from the interview itself, but it explains why a veteran of the Bitfinex laundering case treats the exit as the dangerous phase.
Lichtenstein also told CNN that the hardest part comes after the hack, when the thief must launder fast before getting caught. He called the work terrifying and said he would not recommend it to anyone. Coming from someone who spent years in prison for it, that warning carries weight with younger readers who see crypto theft as a cheap path to riches.
The Two Hard Problems: Breaking In and Cashing Out
CNN’s summary of the conversation splits a major exchange theft into two separate problems. The first is getting inside the exchange and moving the funds out. The second is deciding what to do with them. Law enforcement and defenders face a matching pair of problems, and CNN says Lichtenstein discussed both sets of challenges with Sarlin.
Stage one: getting into the exchange
CNN says Lichtenstein pointed toward the weakest link in the security chain as the place to look. Public reporting backs that framing. Forbes described the Binance breach as one that started with a single engineer’s laptop, and Wikipedia’s summary says the attackers prepared at least 36 hours ahead. Details remain thin, and Binance has not published a full technical post-mortem as of this writing. Reports also describe a mechanism tied to EIP-7702 in the attack, though accounts of how it was abused differ.
Stage two: laundering the proceeds
Laundering is where Lichtenstein spent his own criminal career, and where his commentary lands hardest. Our coverage of the attacker’s activity so far shows exactly the behavior he describes. The thief hunted for exit ramps in lending protocols while those protocols paused to block stolen funds. Each closed door pushes the money toward slower, riskier routes.
Frozen Stablecoins Versus Bitcoin That Cannot Be Frozen
The split between frozen and loose money shows the hot potato problem in numbers. Tether and Circle can blacklist addresses holding their tokens, and they did. CNBC reports that Circle froze more than $800 million of USDC, while Tether CEO Paolo Ardoino said his company froze more than $1.5 billion of USDT. Our own count of that effort, in a piece on issuers freezing $2.84 billion, sits close to the roughly $3 billion CNBC cites.
Bitcoin works differently. No central issuer controls it, so nobody can press a freeze button. Wikipedia’s summary puts about $1.5 billion of the stolen assets in bitcoin that could not be frozen, and about $1.8 billion remaining in the hackers’ hands overall. We tracked one slice of it in a report on the thief parking 18,270 BTC across 19 wallets. Treat the Wikipedia figures as working estimates, since tallies for an event this fresh change daily.
Asset typeCan an issuer freeze it?Reported statusLaundering difficultyUSDC (Circle)YesMore than $800M frozenHigh, tokens can be blocked on flagged addressesUSDT (Tether)YesMore than $1.5B frozenHigh, same issuer-level blacklistBitcoinNo central issuerAbout $1.5B reported unfreezableMedium to high, traceable but not stoppableEther and other tokensDepends on the tokenLargest share by value, per WikipediaMedium, bridges and swaps leave trails
Seen through Lichtenstein’s lens, the freeze numbers are a clean win for defenders. Roughly half the stolen value turned into dead weight within days, which shows how quickly issuers can now act. The bitcoin that remains is the real hot potato, because it is free to move but impossible to spend quietly.
North Korea and the TraderTraitor Attribution
CNN’s report attributes the theft to North Korean hackers. Other outlets sharpen that: TRM Labs, as summarized on Wikipedia, ties the attack to TraderTraitor, a group linked to the Lazarus umbrella. Crypto trade sites TokenPost and Cryptonews report that the FBI also named TraderTraitor and asked DeFi participants to block certain BTC, ETH, and SOL addresses. We could not retrieve an FBI primary document for this article, so treat the FBI detail as secondary reporting until a bureau notice is published.
The attribution fits a pattern. A separate analysis of North Korea’s share of crypto hack value found that groups tied to Pyongyang took about 85% of stolen value in the period it covered. A state actor needs cash more than glory, and that shapes how the laundering plays out. Lichtenstein worked as a private criminal. A state-backed unit has patient, practiced channels for cashing out that individual thieves lack.
You may like
That difference complicates the hot potato metaphor. A nation-state team can hold coins for months, rotate through intermediaries, and accept losses that would ruin an independent hacker. The metaphor still holds for the first few weeks, which is the window defenders are working in right now.
Binance’s Response: 90% Replenished, $6.34B Set Aside
Binance moved quickly on the customer side. The exchange said it had covered 90% of the stolen assets and earmarked more than $6.34 billion in company funds to fulfil a pledge of full reimbursement. The reimbursement spans bitcoin, ether, Tether, and seven other widely traded cryptocurrencies, according to reports from Cointelegraph and Global Banking and Finance. Binance said it was on track to reopen user withdrawals on Sunday, Nov. 1.
The reserve decision, covered in our piece on the $6.34 billion set aside after the hack, answers the first question every customer asks. It does not answer the second one, which is whether the exchange can show its books are clean. Wikipedia lists a proof-of-reserves demonstration as planned for Nov. 2, though we have not seen a Binance statement confirming that date, so watch for an official announcement.
Binance’s CEO Richard Teng has addressed the technical side in public comments summarized by news outlets, but the company has not released a detailed incident report. That gap keeps independent analysts guessing about the exact entry path.
Market Impact: Bitcoin, Coinbase and Robinhood React
Markets did not shrug this off. Bitcoin fell below $80,000 after news of the Binance hack broke, with Wikipedia’s summary describing a drop of about 5%. Yahoo Finance ran a headline noting bitcoin sliding toward $76,000 at one point, so the intraday low depends on the exchange feed you check. Shares of crypto-exposed companies such as Coinbase and Robinhood also fell, per the same summary.
The drop reflects two fears. One is contagion, the worry that other exchanges share the same weaknesses. The other is supply, since a thief holding well over a billion dollars in bitcoin could eventually sell into the market. Neither fear has played out so far. The attacker has so far parked much of the bitcoin rather than dumping it, based on the wallet activity we have covered.
Lichtenstein’s hot potato point speaks to the supply fear directly. If dumping a large position is the fastest way to get caught, a patient thief avoids it. That argues for a slow bleed rather than a single market-shaking sale, a pattern worth tracking in on-chain data over the coming weeks.
How the Binance Hack Compares With Bybit and Bitfinex
Three cases frame this story: the 2016 Bitfinex theft that Lichtenstein was linked to, the 2025 Bybit heist, and the Binance hack. They differ in size, in who the attacker was, and in how fast defenders reacted.
IncidentYearSizeAttribution or outcomeBitfinex hack and laundering2016 theft, 2023 plea$4.5 billion laundering scheme (DOJ)Lichtenstein pleaded guilty, sentenced to five years in 2024Bybit hack2025$1.5 billionPrevious record for a crypto theftBinance hack2026About $6.3 billionAttributed to North Korea-linked TraderTraitor, about $3B frozen
The Bitfinex case shows the endgame Lichtenstein knows best. Investigators followed the coins for years, and the laundering effort ended with arrests and a guilty plea. The Binance hack shows how much faster the response machinery has become. Issuer freezes landed within a day, and public tracing began almost immediately. If the Bitfinex case is the template, Binance’s thief faces years of pursuit.
Historical Context: A Hacker Turned Commentator
Former criminals explaining a fresh crime to a national audience is not new in security. What stands out in this case is the scale. Lichtenstein pleaded guilty to a $4.5 billion laundering scheme, and the Binance hack now dwarfs the Bybit record that stood before it. The man who ran the old record answered questions about the new one.
Read nextBinance’s $6.3B Loss: Crypto Theft Can’t Be Reversed [2026]Cybersecurity · 18 h ago
His arc also shows how crypto enforcement has matured. The Bitfinex case ran from a 2016 theft to a 2023 guilty plea and a 2024 sentence. Today, stablecoin issuers freeze funds within hours and chain analytics firms publish attribution in a day or two. Bobby Lee, founder of the Ballet hardware wallet company, offered a darker read in our earlier piece, saying the stolen bitcoin is likely gone for good. Lee and Lichtenstein stress different points. Lee sees the bitcoin as hard to recover, while Lichtenstein sees it as hard to spend.
The AI Warning Inside the Interview
CNN’s text report says Sarlin asked Lichtenstein whether artificial intelligence poses an existential threat to crypto, and that Lichtenstein answered with an emphatic yes. The report also relays his view that open-source hacking models trail frontier models by about three to six months. We cannot independently verify that timeline, and it comes from his own estimate rather than a published benchmark.
The claim still deserves attention for what it implies. If capable attack tooling spreads from closed labs to open weights within two quarters, the cost of finding the weakest link falls for every attacker, not just state teams. Exchanges that rely on rare, hand-built attacker skill as a defense lose that cushion. This is commentary from one former hacker, so weigh it as a warning rather than a measured forecast.
What the Binance Hack Means for Exchange Security Teams
The practical lesson sits in the first half of Lichtenstein’s framing: find the weakest link. Forbes traced the Binance breach to an engineer’s laptop, a finding echoed in our report on the DevOps laptop cited in the $6.3 billion hit. Exchanges can run elaborate cold-wallet and multi-signature setups, but one compromised developer machine can still open the door.
Security teams can act on three concrete steps. First, treat developer and operator workstations as production-grade targets with hardware-key authentication and strict isolation. Second, separate signing infrastructure so that no single endpoint can authorize a large transfer. Third, rehearse freeze coordination with stablecoin issuers and analytics partners before an incident, because the first hours decide how much money gets locked. Binance’s roughly $3 billion in freezes shows what fast coordination can achieve.
For wider background on how breaches, ransomware, and exchange attacks connect, see our cybersecurity coverage hub.
Five Predictions for the Weeks Ahead
These are our forecasts, built from the reporting above. None is a confirmed fact.
More freezes will follow. As the thief moves tokens through bridges and swaps, issuers and exchanges will flag more addresses, and the frozen total will likely climb past the roughly $3 billion reported so far.Bitcoin will stay the sticking point. Because no one can freeze it, expect the remaining bitcoin to move slowly and in small batches, and expect analytics firms to publish wallet maps.Withdrawal restart will test confidence. Binance targets a restart today, and the first week of outflow data will show whether the 90% replenishment message calmed customers.Exchanges will announce security reviews. Rival platforms have strong reasons to publish endpoint and signing audits in the next few weeks to reassure users.Policy attention will grow. A record theft linked to a state actor gives lawmakers a fresh example, so expect the hack to be cited in crypto security debates.
What We Still Do Not Know
Several gaps remain. Binance has not published a full technical report, so the entry path is still reported rather than confirmed. Totals vary from $6 billion to $6.36 billion depending on the outlet, and the count of frozen funds varies by source. The FBI attribution comes through secondary crypto outlets in our research. And Lichtenstein’s comments, while informed, reflect a former criminal’s view rather than any official finding.
The takeaway: the Binance hack looks like a clean technical success for the attacker and a messy financial problem. The theft took 20 minutes. Turning $6.3 billion into usable money could take years, and as Lichtenstein’s own history shows, the people watching the ledger rarely give up.
Frequently Asked Questions
Who is the notorious hacker explaining the Binance hack?
He is Ilya Lichtenstein, who pleaded guilty in 2023 to a $4.5 billion money-laundering scheme tied to the 2016 Bitfinex hack. A court sentenced him to five years in November 2024, and CNN reports he was released early and now works as a white-hat hacker.
How much was stolen in the Binance hack?
CNBC and NBC News put the figure at about $6.3 billion, while CNN says more than $6 billion. Some trackers cite $6.36 billion. The attack ran for roughly 20 minutes on Oct. 29.
What does the hot potato comparison mean?
Per CNN’s headline, Lichtenstein compares holding stolen crypto to holding a hot potato. Blockchains are public, many eyes watch the stolen funds, and the thief must launder quickly before investigators and issuers catch up.
Who is blamed for the Binance hack?
CNN attributes the theft to North Korean hackers. TRM Labs, as summarized by Wikipedia, points to TraderTraitor, a group linked to Lazarus. Crypto outlets report that the FBI reached a similar conclusion, though we did not see a primary bureau notice.
How much of the stolen money was frozen?
CNBC reports about $3 billion in stablecoins frozen on-chain. Circle froze more than $800 million of USDC, and Tether’s CEO said it froze more than $1.5 billion of USDT.
Will Binance users get their money back?
Binance says it covered 90% of the stolen assets and set aside more than $6.34 billion to reimburse users in full. It said it was on track to resume withdrawals on Sunday, Nov. 1.
Can the stolen bitcoin be frozen?
No central issuer controls bitcoin, so it cannot be frozen the way USDT or USDC can. Wikipedia’s summary reports about $1.5 billion of the stolen value sat in bitcoin that could not be frozen.
More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending nowAO3 Offline 2-4 Weeks After Security Incident [2026]Ransomware Claims Hit 1,127 in October, Up 25.8% [2026]Florida DOE Breach Hits Up to 4.9M, SSNs at Risk [2026]Gears E-Day Sold 62K on Xbox vs 1.7M on Game Pass [2026]GTA 6: 12 New Screenshots Leave Vice City [2026]
Nadia DuboisAI & Innovation EditorNadia Dubois is the AI & Innovation Editor at Tech Insider, where she tracks the rapid evolution of artificial intelligence, from foundation models to real-world enterprise deployment. She previously covered AI and startups for La Tribune and contributed to MIT Technology Review’s European coverage. Nadia specializes in generative AI, AI regulation, and the intersection of technology and European industrial policy. She holds a dual degree in Computational Linguistics and Journalism from Sciences Po Paris.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
