Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History

On Thursday afternoon, attackers siphoned roughly $6.4 billion from Binance, the world’s largest crypto exchange, in a breach that lasted about 20 minutes and spanned ten blockchains. The hack began around 4:05 p.m. ET after a compromised laptop belonging to a DevOps engineer gave the intruders access to a service container, allowing unauthorized withdrawals. Binance says the loss will be covered entirely from its emergency reserve, which holds more than $6.34 billion, and it has halted withdrawals while it investigates the multi‑point breach.

Background

Binance, co‑founded by Changpeng Zhao, operates hot wallets that keep assets online for rapid user withdrawals. Prior to this incident, the largest recorded crypto theft was the $1.5 billion Bybit hack in February 2025. The exchange maintains a Secure Asset Fund for Users, an emergency reserve meant to protect customers in extreme events. Blockchain analytics firms Chainalysis and TRM Labs have become key players in tracing illicit flows, often working with law‑enforcement agencies such as the US Secret Service and the FBI. Stablecoins like USDT and USDC, issued by Tether and Circle, can be frozen by their issuers, a tool that proved crucial when the Binance outflows were detected. The hack also highlighted a newer Ethereum feature, EIP‑7702, which lets ordinary wallets temporarily run smart‑contract code, a mechanism the attackers exploited to turn a Binance hot wallet into a “sweeper” contract. North Korean cyber units, notably TraderTraitor linked to the Lazarus Group, have a history of targeting crypto exchanges to fund the regime’s activities, a pattern that resurfaced in this breach.

What happened

According to decrypt.co, the attackers moved funds out of Binance hot wallets across roughly ten blockchains beginning at about 4:05 p.m. ET on Thursday, completing most of the $6.4 billion transfer within 20 minutes. Chainalysis and TRM Labs estimated the total loss at $6.4 billion, more than four times the previous record. Binance initially traced the breach to a compromised laptop belonging to a DevOps engineer, which may have allowed the attacker to reach a service container and submit unauthorized withdrawals, as reported by both decrypt.co and fortune.com. Binance later disclosed additional breach points, describing a more complex attack that did not rely on a single engineer’s permissions, and noted that the attacker used a self‑destruct mechanism to erase tooling and traces. On Ethereum, the attacker leveraged EIP‑7702, using 50 pre‑signed authorizations to turn a Binance hot wallet into a “sweeper” contract, according to TRM Labs. Both Chainalysis and TRM Labs attributed the hack to TraderTraitor, a North Korean state‑linked group also blamed for the Bybit heist, a view echoed by aljazeera.com. Binance announced it would cover every dollar of the loss with company funds and its Secure Asset Fund for Users, having set aside more than $6.34 billion, including roughly $5 billion already held in the exact tokens stolen. The exchange paused withdrawals, is running a full security review, and aims to restore withdrawals by Sunday while publishing a proof of reserves by Monday. Stablecoin issuers Tether and Circle quickly froze large portions of the stolen USDT and USDC, with Tether freezing more than $1.567 billion and Circle freezing about $823 million, as detailed by interestingengineering.com. Law‑enforcement agencies, including the US Secret Service, are working around the clock with private partners to trace and recover the funds, per techradar.com.

Market impact

The hack sent Bitcoin to a six‑week low of $76,368 and pushed Ether down more than 3 percent, according to aljazeera.com. Chainalysis and TRM Labs reported that about $3 billion of the stolen assets have been frozen, including over $2.3 billion by stablecoin issuers Tether and Circle. Binance’s emergency reserve holds more than $6.34 billion, with roughly $5 billion already in the stolen tokens. The outflows spanned ten blockchains, with an Ethereum transaction moving 167,464 ETH and about $1.615 billion in USDT, while Bitcoin transfers involved 18,270 BTC, roughly $1.44 billion, as noted by interestingengineering.com. The rapid freeze actions by Tether and Circle limited further market erosion, but the sheer scale of the theft has heightened volatility across the crypto sector.

Why it matters

The breach underscores the vulnerability of hot wallets, even at the world’s largest exchange, and raises questions about internal security controls, especially around privileged access and DevOps environments. The use of EIP‑7702 demonstrates how new blockchain features can be weaponised when signing infrastructure is compromised. The attribution to a North Korean group highlights the geopolitical dimension of crypto theft, linking illicit proceeds to funding of sanctioned regimes. The swift freezing of stablecoins by Tether and Circle shows the power of centralized issuers to limit damage, yet also illustrates the systemic risk when large portions of the market rely on such tokens. Regulators in the US, Europe and Asia are likely to intensify scrutiny of exchange security standards, as suggested by commentary in techradar.com, potentially leading to stricter compliance requirements for custodial platforms.