Hackers Drained an Estimated $6.3 Billion From Binance in the Largest Crypto Heist on Record

Hackers drained an estimated $6.3 billion from Binance on Thursday, Oct. 29, in the largest cryptocurrency theft on record.

The bulk of the money left in about 20 minutes, beginning shortly after 2000 GMT on Thursday.

The attackers moved funds across ten blockchains, according to blockchain analytics firm TRM Labs.

The money came from hot wallets, the internet-connected wallets an exchange uses to process withdrawals.

Chainalysis said it had confirmed at least $5.912 billion stolen as of 8:30 p.m. Eastern on Thursday.

Binance's own estimate of the total impact is about $6.3 billion.

The previous largest theft was the $1.5 billion taken from Bybit in February 2025.

How the attackers got in

Binance's first findings pointed to a compromised laptop belonging to a DevOps engineer.

The exchange said that access may have let an attacker reach a service container and submit unauthorized withdrawal transactions.

On Friday, Binance said its investigation had uncovered additional points of breach.

Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions.

He described a more complex attack process, not a single one-click action.

Teng said the attackers used an EIP-7702 delegation to gain execution approval over a hot wallet.

EIP-7702 is an Ethereum standard that lets a wallet delegate its execution to smart-contract code.

"That delegation did not pass through our normal approval controls," Teng said.

The attackers also used a self-destruct mechanism that destroyed tooling and traces as they went, Teng said.

Binance said it has found no evidence of any wallet private key leak.

TRM Labs said the attackers compromised Binance's signing infrastructure, the system that authorizes transactions.

Binance says its own money was taken, and it will cover the loss

Teng said the attack hit Binance's own hot wallet, and that customer funds were not affected.

"We never use any customer funds, so they are not impacted," he said.

Most user assets sit in cold wallets, offline storage, and move to a hot wallet only at withdrawal, he said.

Binance will cover all losses from company funds and its emergency reserve for users, Teng said.

The exchange has reserved more than $6.34 billion, he said.

About $5 billion of that is already held in the affected tokens, including USDC, USDT, BTC, ETH and BNB.

Binance is buying the remainder through market and over-the-counter channels, Teng said.

Deposits are operating normally, Teng said on Friday morning.

Withdrawals remain suspended while the exchange rebuilds and retests its withdrawal service.

Teng said he is very hopeful users can withdraw before the Sunday deadline, within about 40 hours.

About $3 billion is frozen, and the rest is harder to reach

About $3 billion of the affected assets has been frozen with partners' help, Binance said.

Tether froze nearly $1.57 billion, Circle froze more than $800 million in USDC, and Ripple froze about $200 million.

Binance said the frozen figure may continue to increase as teams trace more assets.

Frozen stablecoins cannot be spent by the attacker, but freezing is not the same as recovery.

TRM estimated that about $2.4 billion worth of bitcoin and ether is beyond reach.

No company issues bitcoin or ether, and no issuer can freeze either one.

The attacker was still moving funds on Friday.

A Tron wallet Arkham attributes to the attacker sent about 5.19 million TRX, worth roughly $1.73 million, to 12 addresses between 11:37 a.m. and 12:12 p.m. Eastern on Friday.

Who carried out the attack is not settled

TRM Labs attributes the theft to TraderTraitor, North Korea's elite hacking unit, with high confidence.

That is a researcher's judgment, not a law-enforcement determination.

Binance has not identified the attackers, and its investigation has not attributed responsibility to any individual.

North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts.

Reuters reported that Binance is working with the FBI and the United States Secret Service, citing a person familiar with the situation.

The Secret Service did not respond to a request for comment, Reuters said.

Prices fell, and one lender reopened

Bitcoin fell 3% to $76,469.82 in the Reuters snapshot, hitting a six-week low.

Ether was down more than 3% at $2,185.83 in the same snapshot.

Aave, a decentralized lending protocol, froze its V3 and V4 markets as a precaution after the attack.

Aave unfroze all of those markets on Friday and said its contracts were unaffected.

What remains unknown

What remains unknown is the full attack path, including how the EIP-7702 delegation was obtained.

Also unknown is how much of the frozen money will actually be recovered, rather than only immobilized.

Binance has promised a detailed technical post-mortem once the investigation is complete and every fact is verified.

What to watch is whether withdrawals resume before the Sunday deadline Teng set.

A full Proof of Reserves report, an accounting of the assets backing user balances, is due Monday.