Binance Hack Drains $6.3 Billion in Largest Crypto Theft on Record
Binance said it will cover all losses after hackers stole about $6.3 billion in cryptocurrency from its hot wallets on Thursday, in the largest crypto theft on record. A hot wallet is a wallet connected to the internet so an exchange can process customer withdrawals quickly. The exchange put the impact at about $6.3 billion, while blockchain-intelligence firm TRM Labs traced about $6.36 billion moved out of Binance wallets on ten blockchains, the separate networks that record crypto transactions, most of it in about 20 minutes.
The scale is about four times the $1.5 billion stolen from Bybit in February 2025, the previous record. Binance held roughly $144 billion in platform assets before the hack, according to DefiLlama data cited by CoinDesk, so the theft amounts to roughly 4 percent of holdings.
How the theft unfolded
The theft began at 20:05 UTC on Thursday, when five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address, according to TRM Labs. Minutes later, a Bitcoin hot wallet sent 18,270 bitcoin, and a Tron wallet sent 612.7 million USDT. At 20:24, a single contract call, one automated instruction to blockchain code, emptied a Binance Ethereum hot wallet known as Binance 14, taking 167,464 ether and 63 other tokens, including about 1.615 billion USDT.
The attacker had prepared for at least 36 hours. The operator wallet received small withdrawals from Tornado Cash, a mixer that obscures the source of funds, on the morning of Oct. 28, and the attack code was tested and rehearsed on Oct. 29, TRM Labs reported. An on-chain researcher known as Spreek flagged the outflows publicly at about 20:32 UTC. Binance said it was investigating at about 21:16, paused withdrawals at 22:15, and suspended all deposits and withdrawals at about 00:13 on Friday.
On Ethereum, the attacker used a feature called EIP-7702, introduced in the Pectra upgrade, a scheduled update to the Ethereum network, in May 2025, which lets an ordinary wallet sign an authorization to run a smart contract’s code, a self-executing program stored on the blockchain. Fifty pre-signed authorizations from Binance 14 were bundled into a single transaction, and the one matching the wallet’s live sequence number was accepted, turning the wallet into a sweeper that forwarded funds to the attacker, according to TRM Labs and a CoinDesk reconstruction of Etherscan data. A sequence number is a counter that rises with each transaction and stops old authorizations from being reused. A sweeper is code that forwards any funds it receives straight to the attacker. The delegation stayed live for about four hours and swept new deposits as they arrived.
What Binance says happened
Binance’s preliminary account is that the incident may have involved a compromised laptop belonging to a DevOps engineer, a staff engineer who builds and runs the systems that deploy and operate the exchange’s software, which let an attacker reach a service container, a packaged unit of software running part of the exchange’s operations, and submit unauthorized withdrawal transactions. The exchange said it found no evidence of a wallet private key leak. A private key is the secret code that controls a wallet. On Friday, Binance said its investigation had uncovered additional points of breach and that the attack was not the work of one engineer’s permissions alone, without identifying the other points. The account remains preliminary; Binance’s own wording is “may involve” and “suggests.”
How the attacker obtained valid signatures on ten different blockchains is unresolved. TRM Labs assessed that the pattern points to a compromise of Binance’s hot-wallet signing infrastructure, the systems that approve and sign withdrawals, while Blockaid described it as “key misuse,” tricking or compromising a signing system without extracting the private key. Neither assessment is confirmed by Binance, and the exchange has not published a root cause.
The money trail and the freezes
Stablecoin issuers moved quickly to freeze what they could. A stablecoin is a token whose value is pegged to the dollar. Tether froze about $1.77 billion in USDT, its dollar-pegged token, and Circle froze about $825 million in USDC, its own dollar-pegged token, according to TRM Labs, and Ripple froze 40.5 million RLUSD, its dollar-pegged token, on-chain. Binance put the verified frozen total at about $3 billion. A freeze is not a return: frozen assets limit the attacker’s ability to convert them into cash, but no path for their return has been stated.
The attacker moved fast to convert what issuers could not freeze. TRM Labs reported the attacker sold about $325 million in USDT through UniswapX, a service that routes token swaps across decentralized exchanges, for about 122,300 ether at a discount of more than 10 percent, and borrowed about 19,760 ether on Aave, a lending platform where users borrow against crypto collateral, against $60 million in USDT collateral, assets pledged to secure a loan. The attacker still held more than 420,000 ether and 18,270 bitcoin, about $2.4 billion, beyond any issuer’s reach, according to TRM Labs.
What it means for users and markets
Binance said user funds are safe and it will cover all losses from its SAFU emergency fund and company funds. SAFU is an emergency reserve built for events of this kind. On Friday, the exchange said it had set aside more than $6.34 billion, with $5 billion already held in the exact tokens affected, so balances can be restored one-for-one. The SAFU fund itself holds about $1 billion in bitcoin, so company resources are doing most of the work.
There is a nuance in the “safe” pledge. CoinDesk’s review of Binance’s own Oct. 1 proof of reserves found that the drained wallets are the same wallets listed as backing customer balances. Proof of reserves is the monthly report in which an exchange lists the wallets it controls and compares their holdings with customer balances. Binance then held exactly 100 percent of customers’ ether, so the roughly 204,500 ether taken would leave ether backing near 94 percent until Binance replaces the assets. The next reserve snapshot, due Nov. 1, will show whether the gap has been filled. Withdrawals remained paused on Friday morning, with resumption expected in about 45 to 48 hours. Deposits were described as operating normally. Binance.US, a separate platform, said it was not affected.
Markets fell sharply and then partly recovered. BNB, the token tied to Binance’s ecosystem, fell from $744.90 to $680 in the hour the theft became public, an 8.7 percent drop, before bouncing to about $720. Bitcoin fell from $80,849 to about $76,500, and ether from $2,337 to $2,174. About $1.55 billion in leveraged positions, bets made with borrowed money, was liquidated, forcibly closed by exchanges when prices moved against them, in 24 hours, according to CoinGlass data. About 84 percent of it was long bets. The crypto Fear and Greed Index, a 0-to-100 gauge of market sentiment, fell from 51 to 30, into “fear.”
The sell-off coincided with weakness in stocks, after the Federal Reserve held rates steady and big technology earnings disappointed, so the hack alone did not cause every move. Standard Chartered warned that prices could stay under pressure until more details emerge, and said the incident could encourage a shift toward decentralized exchanges, marketplaces that run on blockchain code without a central operator.
Attribution is unresolved. TRM Labs and Chainalysis said with high confidence that the attack was the work of TraderTraitor, a North Korean state-backed hacking unit, citing commingling with proceeds from an earlier exploit of the Bitget exchange. Binance has not attributed the attack to any group, and no government agency had publicly confirmed attribution as of Friday. Reuters reported, citing a single person familiar with the matter, that Binance is working with the FBI and the U.S. Secret Service; neither agency publicly confirmed it. No regulator statement had been found, and no arrests had been reported. Binance has promised a detailed post-mortem, a full technical account of how the attack happened, once its investigation is complete.
