Binance hit by record $6.3B hack; $3B frozen, withdrawals restart within 40 hours
Binance, the world's largest crypto exchange (a platform where people trade cryptocurrencies), says it suffered a record hack with an estimated impact of about $6.3 billion. Around $3 billion in stolen crypto has been frozen so far, and that figure could rise as investigators trace more assets. Binance has set aside more than $6.34 billion in company funds to cover the losses.
The exchange says deposits are working normally and withdrawals are expected to resume on schedule. Co-CEO Richard Teng said Binance is aiming to restore withdrawals within 40 hours and publish a full proof-of-reserves report (a statement showing the exchange holds the assets it owes users) by Monday. Initial findings pointed to a compromised DevOps engineer's laptop, but Binance says it has since found additional points of breach and has not blamed any individual.
Key numbers and facts
- Estimated total impact: about $6.3 billion (analyst Jonathan Levin put it at $6.4 billion).
- Verified frozen crypto: $3 billion, which could increase.
- Binance has reserved more than $6.34 billion in company funds, including $5 billion already held in the same tokens that were stolen.
- Deposits operate normally; withdrawals paused and expected back within 40-48 hours.
- Binance is working with the FBI on recovery, per a source familiar with the matter; the exchange confirmed law-enforcement cooperation without naming agencies.
- Security analysts suspect North Korea's TraderTraitor group, which the FBI has previously named for the Bybit hack.
Who is suspected, and how confident
Attribution is not confirmed by Binance. Chainalysis CEO Jonathan Levin said the hack was likely carried out by TraderTraitor, a North Korea-linked hacking group, citing links to a previous attack. TRM Labs attributed the attack to TraderTraitor with "high confidence," based on what it called robust on-chain and off-chain intelligence. Blockaid CEO Ido Ben-Natan said the attack resembled North Korea's work based on sophisticated on-chain preparations. On-chain investigator ZachXBT said funds from this attack and the earlier Bitget exploit were commingled in the same address, suggesting the same actor is likely behind both incidents.
How the attack worked
Teng said the attacker used an EIP-7702 delegation — an Ethereum feature that lets a wallet temporarily delegate its signing authority to another address — to gain execution control over a hot wallet (an internet-connected wallet used for daily operations). He said that delegation "did not pass through our normal approval controls." He also said the attack was not a single "one-click" action but a more complex process, and that investigators found no evidence of a wallet private-key leak. The attacker used a "self-destruct mechanism" to destroy tools and traces, complicating the investigation.
Security firms say EIP-7702 was not strictly necessary — the funds could have been stolen without it — but Blockaid's CEO said it may have let the attackers bypass security checks and move funds "in one sweep" instead of many transactions. Ambire CEO Ivo Georgiev warned that engineers can overlook revoking malicious EIP-7702 delegations after regaining control of their systems.
Money is moving through unusual patterns
Chainalysis says the attackers may be automating money laundering (disguising the origin of stolen funds). It reported "never-seen-before" laundering patterns, with thousands of transactions in a short period, funds repeatedly circulating among addresses, and sometimes returning to wallets used earlier in the sequence.
What was frozen and what Binance is replacing
Frozen assets are mostly stablecoins (tokens pegged to the US dollar) and other tokens: USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Co-CEO Yi He said Binance is buying altcoins in quantities matching those stolen, through over-the-counter deals and on exchanges, ahead of updated proof of reserves. A spokesperson said the $5 billion in matching tokens is held in Binance's custody, but declined to share wallet addresses or say when the assets were acquired. Some purchases may take longer due to low liquidity and OTC settlement times. Binance also submits weekly reports on company funds to Abu Dhabi's financial regulator, a requirement that predated the hack.
Separately, the lending protocol Aave (where users lend and borrow crypto) briefly froze new deposits and borrowing as a precaution, then restored them across all V3 and V4 markets. Aave said its contracts were unaffected and all positions stayed overcollateralized.
What is confirmed vs. suspected
Confirmed by Binance: the roughly $6.3 billion estimated impact, the $3 billion frozen, the $6.34 billion reserve, the EIP-7702 delegation bypassing approval controls, additional breach points, and the withdrawal timeline. Reported but unconfirmed: attribution to North Korea's TraderTraitor (analyst claims, not admitted or proven) and the exact role of EIP-7702 (security firms say it was helpful but not essential). The FBI's specific involvement comes from a single unnamed source, while Binance has only confirmed working with law enforcement generally.
Why it matters
This is described by the sources as the largest crypto hack in history, exceeding prior exchange thefts attributed to the same suspected group. The freezing of about $3 billion in stablecoins shows how quickly issuers and industry partners can block stolen funds, though Chainalysis says the rest is being moved with unusual automation. Binance covering losses from its own funds, including the SAFU emergency fund, means users are not directly bearing the loss, but the breach points and the bypassed approval control raise questions about exchange security that the Monday reserves report and investigation updates will address.
What happens next
Binance says withdrawals should resume within 40 hours, with hopes to restore access before its Sunday deadline, and a full proof-of-reserves report is due Monday with an initial snapshot before then. Recovery efforts with law enforcement and industry partners continue, and frozen-fund totals may grow as tracing progresses.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.