Binance’s $6.3B Hack Is History’s Biggest Heist—But the Exit Queue Looks Familiar 🫣

Binance said it suffered a security incident estimated at $6.3 billion after attackers drained assets linked to the exchange’s hot wallets across multiple blockchains, making it the largest cryptocurrency theft on record. The exchange has frozen about $3 billion with blockchain partners, reserved more than $6.34 billion in company funds, and said 90% of affected assets had been replenished by Saturday. Withdrawals began resuming through a phased rollout on Sunday, initially including Bitcoin.

Binance initially described the incident as a “potential security issue,” stating, “We have not confirmed any impact to user funds.” Co-CEO Richard Teng later said, “Bottom line - your money is safe, and we're covering every loss,” before explaining that the attack was more complex than the use of one engineer’s permissions. “Our investigation has not attributed responsibility to any individual,” he wrote. The exchange said a compromised DevOps engineer’s laptop may have provided initial access, but its investigation subsequently found “additional points of breach.”

On-chain investigators attributed the theft to North Korea’s TraderTraitor group. TRM Labs estimated the theft at about $6.36 billion across 10 blockchains, while Chainalysis put it at approximately $6.4 billion. Both firms cited links with earlier North Korean operations, including the $1.5 billion Bybit hack in February 2025. TRM Labs said the operational wallet was funded through Tornado Cash and that 50 pre-signed EIP-7702 authorizations were used to turn a Binance hot wallet into a controlled sweeper. Binance said it found no evidence of a wallet private key leak, although investigators believe the signing infrastructure was compromised.

Blockaid co-founder and CEO Ido Ben-Natan said the preliminary assessment pointed to “key misuse,” adding, “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked.” He said the theft could have been completed without EIP-7702, although the feature may have enabled a single sweep or bypassed some security checks. Binance said the attacker used a self-destruct mechanism to destroy tools and traces, while Chainalysis reported observing thousands of rapid transactions consistent with automated laundering.

Tether froze more than 1.567 billion USDT, while Circle froze more than 800 million USDC. Founder Changpeng Zhao wrote, “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m), I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.” Binance said it would cover all losses through its Secure Asset Fund for Users and company funds, with $5 billion already held in the same tokens affected by the incident. It also said $BTC, $ETH, $BNB, $XRP, $SOL, USDT, USDC, USD1, RLUSD and ZEC were fully backed, and that withdrawals would be restored across 15 networks in stages.