Binance’s $6.3B Vault Gives Way: Record Heist Leaves the Crypto Giant Counting Every Coin 🪙

Binance has confirmed that a security incident drained approximately $6.3 billion from its hot wallets, making it the largest cryptocurrency theft on record, and said it has replenished 90% of the affected assets. The exchange initially suspected that a compromised DevOps engineer’s laptop allowed an attacker to access a service container and submit unauthorized withdrawal transactions, but later uncovered “additional points of breach.” Binance co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” while the exchange reported no evidence that wallet private keys were compromised.

On Ethereum, the attacker used EIP-7702 delegations to turn a Binance hot wallet into a controlled “sweeper,” according to TRM Labs and Blockaid. TRM said 50 pre-signed authorizations were bundled into one transaction, while Binance said the delegation “did not pass through our normal approval controls.” The attacker also deployed a “self-destruct mechanism” to erase tools and traces. Blockaid co-founder and CEO Ido Ben-Natan said the attack likely compromised signing infrastructure rather than exposing a private key: “The takeaway is that ultimately the signer signed a transaction that they shouldn’t have.”

Blockchain analytics firms TRM Labs and Chainalysis attributed the attack with high confidence to North Korea’s TraderTraitor group. Their estimates placed the theft at approximately $6.36 billion and $6.4 billion, respectively, with funds moving across 10 blockchains. Chainalysis identified the strongest evidence when funds stolen from Binance commingled with assets from September’s Bitget exploit, while TRM cited the attacker’s use of Tornado Cash, advance preparations and transaction patterns linked to earlier North Korean operations.

Binance said about $3 billion in affected assets had been frozen with help from blockchain partners. Frozen balances include Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB). Circle froze more than $800 million in USDC, while Tether CEO Paolo Ardoino said more than 1.567B USDT had been frozen. The FBI confirmed it was aware of the incident and working with public and private partners, and Reuters reported that Binance was also cooperating with the U.S. Secret Service.

To cover the losses, Binance reserved more than $6.34 billion in company funds, including $5 billion already held in the same tokens affected by the attack. It said assets including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, with the remaining balances to be purchased through market and over-the-counter (OTC) channels. Teng said, “We are committed to covering all hacked losses through our company funds. Your assets are safe.” Withdrawals remained suspended while Binance rebuilt and tested its withdrawal infrastructure, with the exchange targeting a Sunday restart and a full proof-of-reserves report by Monday.