Inside the $6.3 billion Binance hack — the largest crypto heist on record
Binance hit by record-breaking crypto hack
Binance, the world's largest crypto exchange — a platform where people buy, sell, and store digital currencies — was hit by the biggest crypto hack in history. Blockchain investigators estimate more than $6 billion in assets were stolen.
The breach happened on a Thursday and has raised serious questions about the security of centralized exchanges, particularly the hot wallets (online storage systems) used to hold billions of dollars in customer funds.
Key facts about the breach
- Investigators estimate over $6 billion in crypto was stolen, making it the largest crypto hack on record
- Three major blockchain analysis firms attribute the attack to North Korean hacking groups
- Binance says it has roughly $6.3 billion available to cover all losses from the hack
- The exchange is working to restore customer withdrawals and aims to meet a Sunday deadline
- Attackers targeted internal systems and wallet-signing infrastructure, not just a single vulnerability
Binance's account of the attack
Binance's initial investigation points to a compromised DevOps engineer's laptop and unauthorized access to a service container. The exchange has not confirmed a private key (secret code that proves ownership of crypto assets) leak.
Co-CEO Richard Teng has described the attack as more complex than just one employee's credentials being compromised.
Binance has approximately $5 billion in affected assets and is acquiring another $1.3 billion through market and over-the-counter channels to cover all losses.
How the attack was carried out
According to blockchain analysis firm TRM Labs, the attackers began preparing at least 36 hours before the theft. They funded an operational wallet with small withdrawals from Tornado Cash, a crypto mixing service, and tested malicious code on three wallets before launching the main attack.
On Ethereum — the second-largest blockchain, a shared digital ledger that records transactions — the attackers used a technical standard called EIP-7702 to turn a Binance hot wallet into a "sweeper" they controlled. They prepared 50 pre-signed authorizations to make sure at least one would work when executed.
TRM Labs says coordinated transfers across nine other blockchains suggest the hackers gained access to Binance's broader hot-wallet signing infrastructure, not just one wallet.
Another analysis firm, Elliptic, found evidence the attackers retained access after the initial exploit. They used one compromised wallet's permissions to withdraw funds from another Binance wallet and repeatedly swept new deposits. A second Ethereum hot wallet also sent $174 million directly to the attackers.
Simone Imbrescia, vice president of crypto bug bounty platform Immunefi, noted the attack was surprisingly simple from a code perspective. The sweeper contract was only about 130 lines of code. The real sophistication came from gaining access to the powerful internal systems.
Investigators link attack to North Korea
Three major blockchain analysis firms — Chainalysis, Elliptic, and TRM — have all attributed the attack to North Korean hacking groups.
TRM Labs explicitly links it to the same group behind the $1.5 billion Bybit hack in 2025. Chainalysis found onchain connections between the stolen Binance funds and last month's Bitget exploit, which was also blamed on North Korean hackers.
However, Elliptic cautioned that the onchain overlap with the Bitget incident involves only a small portion of the Binance funds and does not conclusively prove the same attackers were responsible.
TRM cited several similarities to previous North Korean operations, including Tornado Cash funding, advance planning, and the use of pre-signed authorizations.
How attackers moved the stolen funds
Chainalysis identified thousands of transactions in a short period, with stolen funds moving rapidly between different crypto addresses in an apparent attempt to confuse tracking.
The attackers converted $325 million in stablecoins — digital currencies whose value is tied to real-world money like the U.S. dollar — into $285 million in Ethereum over about 20 minutes. This was likely to avoid having the stablecoins frozen by their issuers.
Elliptic reported that the attacker deposited $59.9 million in stolen Tether (USDT, a popular stablecoin) into Aave, a decentralized lending platform, as collateral and borrowed 19,762 Ethereum. The loan was still open and close to being liquidated at the time of Elliptic's latest update.
The attackers also swapped hundreds of millions of dollars in USDT for Ethereum through decentralized exchanges and market makers, accepting losses of up to 26% below market prices to get assets that cannot be frozen by issuers.
Aave said on Friday that it had unfrozen all markets across its V3 and V4 protocols, confirming its smart contracts (self-executing code on blockchains) were not affected and user positions remained fully collateralized.
What this means for crypto security
Analysts at TD Cowen said the breach highlights the custody and cybersecurity risks that come with using centralized crypto exchanges. But they noted the incident does not mean the broader digital asset industry is fundamentally flawed.
"The evidence available so far points to a compromise of infrastructure at a centralized intermediary, rather than a failure of Bitcoin or its underlying network," the analysts wrote. They compared it to a bank robbery — people do not stop using dollars because one bank was robbed.
Imbrescia from Immunefi said the incident shows that crypto security efforts need to focus on more than just protecting private keys and auditing smart contracts. The people, infrastructure, and workflows that control those keys are also critical security targets.
"If an attacker compromises that operational layer, they may not need to steal a key or discover an exotic smart-contract vulnerability at all," Imbrescia said.
Binance's recovery timeline
Teng said Binance is targeting Monday to publish its initial proof-of-reserves report — an independent verification showing the exchange has enough funds to cover all customer deposits.
The exchange is working to restore customer withdrawals. Teng said in a video posted Friday that the team is "very hopeful" users will be able to withdraw before the Sunday deadline, which would be within 40 hours of the incident.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.