Key Points
- Elon Musk posted “Everyday is Zeroday” and replied with fire and laughing emojis to a thread about CZ’s earlier phishing warning, triggering a public exchange with CZ.
- CZ responded directly: “Elon, have a lot of respect for you, but bad time to troll. Please stop.” He cited Binance’s SpaceX stake, now worth over $1 billion from an original $500M Twitter acquisition investment.
- CZ’s rough math: $6.x billion stolen, ~$3 billion frozen, $1.x billion SAFU, leaving a ~$2 billion gap he called “still painful, but manageable.”
- Binance co-founder Yi He said the company’s annual revenue is sufficient to cover all losses without selling the SpaceX stake. CZ later clarified he was not signalling a sale, just showing Musk Binance’s available assets.
- TRM Labs has attributed the October 29 attack to TraderTraitor (Lazarus Group) with high confidence. Entry point was a compromised employee computer; exploit vector was EIP-7702, the Ethereum Pectra upgrade feature enabling delegation of EOA accounts.
- Withdrawals remain paused as of October 30. Deposits are unaffected. Binance has pledged to cover all losses through SAFU and company funds.
This is a follow-up article
This article covers the October 30 public exchange between Elon Musk and CZ, updated loss math, and a step-by-step technical flowchart of how the attack unfolded. For the original breaking report including TRM Labs attribution, SAFU coverage, service update, and chain-by-chain breakdown, see: Binance Hack: $6.36 Billion Stolen by North Korea’s Lazarus Group Using EIP-7702.
The day after the largest crypto hack in recorded history, Elon Musk chose to joke about it. The exchange that followed on X produced the most-watched public back-and-forth of the Binance incident and surfaced a detail most users did not know: Binance holds a stake in SpaceX worth over $1 billion.
Musk Trolls. CZ Responds. Yi He Closes It.
Musk posted “Everyday is Zeroday” as a standalone comment on the hack, a reference to zero-day security vulnerabilities that are exploited before any defence can be mounted. He also replied to a user thread about CZ’s earlier warning about malicious email attachments with fire and laughing emojis, highlighting what he saw as irony in a major exchange getting compromised shortly after its founder publicly cautioned users about phishing.
“Elon, have a lot of respect for you, but bad time to troll. Please stop.”
Changpeng Zhao (CZ) | X, October 30, 2026
CZ did not stop at asking Musk to stand down. He also surfaced Binance’s financial position in a way that reframed the conversation. Binance was among the investors in Musk’s $44 billion Twitter acquisition in 2022, committing $500 million. Twitter’s assets were later absorbed into xAI, which then merged with SpaceX after SpaceX went public earlier in 2026. CZ told Musk that Binance’s SPCX shares from that original investment are now worth more than $1 billion, more than double what Binance put in. The message: we have the reserves, and some of them are in your company.
Binance co-founder Yi He then stepped in to clarify: Binance’s annual revenue alone is enough to absorb the losses. The SpaceX stake is not being earmarked. CZ later confirmed he was not signalling a sale. The SPCX mention was to show Musk, and the market, that Binance has well over $1 billion in a single known public holding. The actual coverage plan is SAFU and company operating funds.
“The loss might be a bit higher than that, but will cover.”
CZ | X, October 30, 2026
CZ’s gap math as stated on X
$6.x billion stolen. ~$3 billion frozen on-chain by cooperating exchanges and chains. $1.x billion in SAFU. Remaining gap: approximately $2 billion. CZ’s words: “still painful, but manageable.” He noted Binance holds over $1 billion in SPCX alone, without any plans to sell it.
How the Attack Happened: Step by Step
TRM Labs attributed the attack to TraderTraitor, the North Korean state unit also known as Lazarus Group, with high confidence. Binance confirmed in its service update that the entry point was a compromised employee computer. The exploit mechanism was EIP-7702, an Ethereum Pectra upgrade feature that, when abused, allows an externally owned account to delegate execution to an attacker-controlled smart contract.
EIP-7702 Attack Flowchart: How $6.36B Was Stolen in 20 Minutes
The attack’s defining technical feature is Step 4. EIP-7702 was introduced as part of Ethereum’s Pectra upgrade to enable smart account functionality for regular wallets. In legitimate use, it allows a user to temporarily grant a smart contract control of their wallet for a specific operation, such as batched approvals. In TraderTraitor’s hands, it became a mechanism to permanently redirect Binance’s hot wallet funds to attacker-controlled contracts without triggering the signing key alarms that traditional withdrawal monitoring is built around.
What EIP-7702 does and why it was dangerous here
EIP-7702 lets an externally owned account (a standard Ethereum wallet controlled by a private key) sign an authorization that delegates execution to a smart contract. The wallet’s private key is never exposed. But after the delegation is signed, any call to that wallet address executes through the attacker’s contract instead of the wallet’s own logic. Binance’s hot wallet continued to look like a legitimate address. Its signing keys were not compromised in the traditional sense. The exploit worked at the application layer, not the cryptographic one, which is why detection took time.
Binance Service Update: Where Things Stand
Binance’s official service update confirmed that deposits are functioning normally and user balances are unaffected. Withdrawals have been paused for approximately 48 hours while the security team completes forensic review of all hot wallet infrastructure. The exchange has committed to covering 100% of losses through the SAFU emergency reserve and company operating funds. No user funds are at risk.
The entry point, per Binance’s confirmed statement, was a compromised employee computer rather than a breach of Binance’s core signing infrastructure. This distinction matters: it means the Secure Element and hardware signing systems were not directly compromised. The attacker used EIP-7702 delegation to route around them after gaining sufficient internal access to initiate the authorization.
FBI and Secret Service Are In. Circle and Tether Already Froze Billions.
The US Secret Service confirmed it is working with private-sector partners, specifically naming Circle, to identify, freeze, trace, and recover stolen funds. The FBI is also working with Binance, according to a source cited by Reuters. No specific amounts recovered by law enforcement have been disclosed.
The freeze picture is now substantially clearer. Tether froze approximately $1.57 billion in assets linked to the hack. Circle froze over $800 million in USDC. Ripple froze roughly $200 million, per Yi He. World Liberty Financial, working with custodian BitGo, froze $27 million in stablecoins and around $2 million in WLD tokens. Combined with other chain-level freezes, the total frozen across all parties has reached approximately $2.75 billion, around 46% of what was taken.
Binance Is Buying Back What the Hacker Sold
Binance has reserved more than $6.34 billion to make users whole. Around $5 billion of that is already held in the same tokens that were taken. For the remainder, Binance is buying back tokens on exchanges and through OTC desks, matching the stolen amounts exactly. The buyback calculations exclude the roughly $3 billion frozen by issuers and law enforcement.
The hacker has already moved some funds. On-chain data tracked by Lookonchain shows the attacker sold 7.02 million UNI ($39.6M), 7.77 trillion PEPE ($31.7M), 217.5 million ENA ($33.9M), and 2.57 million LINK ($26M), converting those into approximately 70,480 ETH worth $158 million. Binance is acquiring those sold tokens back on the open market. Some purchases may take longer given thin liquidity in certain altcoins. Binance has said it will publish a full update once the repurchases are complete.
“Binance has committed its own balance sheet to making customers whole. I expect it to deliver.”
Michael Saylor, Executive Chairman, Strategy | X, October 30, 2026
CZ has said Binance can cover losses without outside help, declining an offer of liquidity assistance from Gulf Binance, its Thai partner. The SAFU fund and existing company holdings in BTC and ETH are the primary coverage vehicles.
The SpaceX Angle: xAI, Twitter, and $500M That Doubled
Binance’s $500 million Twitter investment in 2022 was one of the largest third-party stakes in that acquisition. When xAI acquired X (formerly Twitter) and xAI subsequently merged into SpaceX following SpaceX’s 2026 IPO, Binance’s stake converted to SPCX shares. CZ’s public valuation of over $1 billion for that holding has not been independently verified, but the trajectory of SpaceX’s post-IPO valuation makes it plausible. What makes the X interaction striking is that Musk is effectively the counterparty to that investment, owning and controlling the entity whose shares Binance holds as a reserve asset.
Live: Where the Stolen $5.99B Is Right Now
LayerHub is running a real-time on-chain tracker for the Binance hack. As of October 30, the picture looks like this: roughly 46% of what was taken is frozen or seized, 52% is still with the hacker across active wallets, and just 1.5% has been sold or moved out. The tracker updates live and you can look up individual wallets.
LayerHub Live Tracker — October 30, 2026
Where the money went (by network)
Data: LayerHub live tracker — updates in real time. Prices at time of snapshot, October 30, 2026.
Frequently Asked Questions
What did Elon Musk post about the Binance hack?
Musk posted “Everyday is Zeroday” as a comment on the hack, a reference to zero-day security vulnerabilities that are exploited before any defence is in place. He also replied with fire and laughing emojis to a user thread about CZ’s earlier warning about malicious email attachments, drawing attention to the irony of a major exchange being compromised shortly after its founder’s public phishing caution.
How did CZ respond to Elon Musk?
CZ told Musk directly: “Elon, have a lot of respect for you, but bad time to troll. Please stop.” He then cited Binance’s SpaceX (SPCX) stake, worth over $1 billion, to demonstrate Binance’s balance sheet strength. He later clarified he was not planning to sell the stake, only showing that Binance has assets well in excess of the coverage gap.
Does Binance own SpaceX shares?
Yes. Binance invested $500 million in Elon Musk’s 2022 Twitter acquisition. That stake eventually converted to SPCX shares after xAI acquired Twitter, then merged into SpaceX following SpaceX’s 2026 IPO. CZ said the position is now worth over $1 billion. The valuation has not been independently verified. Binance is not planning to sell.
How exactly did the Binance hack work?
A Binance employee’s computer was compromised via spearphishing. TraderTraitor used that internal access to map Binance’s hot wallet infrastructure and then exploited EIP-7702, an Ethereum Pectra feature that allows delegation of an externally owned account to a smart contract. Once the delegation was signed, the attacker’s contract controlled the wallet’s execution, draining $6.36 billion across 10 chains in approximately 20 minutes.
Will Binance cover all losses?
Yes, per Binance’s official statement. Coverage comes from the SAFU emergency fund (approximately $1 billion in BTC) and company operating funds. Yi He confirmed annual revenue alone is sufficient to absorb the loss without touching the SpaceX stake. Withdrawals are paused approximately 48 hours; deposits are live and user balances are unaffected.
Further Reading
The original CNB breaking report: TRM Labs attribution, service update, chain-by-chain breakdown, freeze status table, and how EIP-7702 was weaponised.
The other major October 2026 hardware wallet breach: STM32 cellular implant, CryptoBilis reseller ownership change, Tether freeze, and Ledger’s new global reseller rules.
How TRM Labs, the same firm that attributed the Binance hack to TraderTraitor, uncovered a separate AI-branded scam campaign targeting retail users.
Sources: Bitcoin.com News, Finbold, BeInCrypto, crypto.news, LayerHub live tracker, Lookonchain on-chain data, TRM Labs attribution statement, Binance official service update, US Secret Service statement, Reuters (FBI/Secret Service), CZ X posts October 29-30 2026, Yi He public statement, Michael Saylor X post October 30 2026 | Published October 30, 2026 | CryptoNewsBytes.com | Not financial advice.
