Binance Loses $6.4 B in Record‑Breaking Crypto Heist; Exchange Vows Full Reimbursement

In brief

• Attackers stole roughly $6.4 billion from Binance on Thursday, marking the largest cryptocurrency theft on record—over four times the previous benchmark.
• Binance has pledged to absorb the entire loss using corporate funds and its Secure Asset Fund for Users, having earmarked more than $6.34 billion to cover the shortfall.
• This article explains how the breach unfolded and the steps being taken to mitigate the damage.

The cryptocurrency market suffered its most significant security breach in history.

Here’s what is currently known about the Binance hack.

What happened

The theft began at about 4:05 p.m. ET on Thursday, after U.S. markets had closed, when attackers moved funds out of Binance hot wallets across roughly ten blockchains, most of them within about 20 minutes.

Blockchain analytics firms Chainalysis and TRM Labs put the total at around $6.4 billion, more than four times the previous record, February 2025’s $1.5 billion Bybit heist.

Crucially, the attack targeted Binance’s own infrastructure rather than the underlying blockchains. Binance initially traced the breach to a compromised laptop belonging to a DevOps engineer, which may have given the attacker access to a service container and allowed unauthorized withdrawals.

The exchange later reported uncovering “additional points of breach,” with CEO Richard Teng describing “a more complex attack process” that “did not simply use one engineer’s permissions.” Binance said it found no evidence that wallet private keys had been leaked, and that the attacker employed a self‑destruct mechanism to erase tooling and traces.

The Ethereum wrinkle

On Ethereum, the attacker exploited EIP‑7702, a feature introduced in 2025 that allows ordinary wallets to temporarily execute smart‑contract code.

With 50 pre‑signed authorizations, the attacker converted a Binance hot wallet into a “sweeper” contract and drained its assets, TRM Labs reported.

Teng noted that the delegation “did not pass through our normal approval controls.” The incident did not reveal a flaw in Ethereum itself; rather, TRM suggested it highlighted a compromise of Binance’s signing infrastructure.

Who’s behind it

Both TRM Labs and Chainalysis have attributed the hack to TraderTraitor, a North Korean state‑linked group also blamed for the Bybit heist.

Following that incident, the group converted roughly 84 % of the stolen Ethereum into Bitcoin through the cross‑chain network Thorchain. The attribution raises North Korea’s 2026 cryptocurrency earnings past $1 billion, dwarfed only by the Binance breach.

What Binance is doing

Teng announced that Binance will cover the entire loss using company funds and its Secure Asset Fund for Users, an emergency reserve, emphasizing that customer assets were never compromised.

Binance has allocated more than $6.34 billion to the shortfall, of which roughly $5 billion is already held in the specific stolen tokens (BTC, ETH, BNB, USDC, and USDT). The remainder is being purchased on the open market and via over‑the‑counter trades.

Withdrawals were paused while Binance rebuilt and retested its systems, initiated a comprehensive security review, and plans to resume withdrawals by Sunday, accompanied by a full proof of reserves on Monday. Deposits continue to operate normally.

The freeze, and what’s still loose

Stablecoin issuers moved quickly to freeze assets after the initial reports of the breach, a response that contrasted with previous security incidents.

Stablecoins underpin the crypto economy as dollar‑pegged tokens that maintain a steady value and enable quick transactions on both centralized and decentralized exchanges. Unlike native digital currencies such as Bitcoin or Ethereum, stablecoins are centrally issued and managed by private firms, allowing their operators to freeze funds at any time and for any reason.

Tether, the company behind the leading stablecoin USDT, froze over $1.5 billion in assets. Circle, issuer of the second‑largest stablecoin USDC, froze approximately $823 million linked to the breach. Both firms exercised their power to blacklist specific addresses.

Overall, about $3 billion has been frozen or traced. Yet a large sum stays beyond the reach of issuers: the attacker still controls more than 420,000 ETH and 18,270 BTC, as well as other tokens worth over $3 billion, continually moving them through Tron and other networks. Security firm Elliptic estimated the hacker still possesses roughly $3.3 billion.

The investigation

Binance is cooperating with law‑enforcement agencies worldwide, including the FBI and the U.S. Secret Service.

The FBI confirmed it is aware of the incident and is coordinating with partners, while the U.S. Secret Service, which investigates financial and digital‑currency crimes, declined to comment.

The response mirrors earlier collaborative efforts like Operation Atlantic in April, which successfully traced tens of millions in stolen cryptocurrency.

How markets reacted

For a theft of this magnitude, markets remained surprisingly calm.

Bitcoin slipped to roughly $76,400 on Friday, a decline of about 4 %, and over $1.3 billion in leveraged positions were liquidated.

This is a far cry from March 2018, when a failed attack on Binance erased nearly 11 % of Bitcoin’s value within minutes. Analysts attribute the muted response to a larger, more mature market now worth around $2.6 trillion and spot Bitcoin ETFs holding roughly 1.3 million BTC, which have dampened panic‑selling.

Wall Street firms such as Cantor Fitzgerald, TD Cowen, and Compass Point encouraged clients to purchase crypto‑linked equities on the weakness, characterizing the incident as a Binance security lapse rather than a danger to the broader crypto technology.

The fallout

CFTC Chairman Michael Selig seized on the breach to advocate for U.S. oversight of offshore exchanges. In a CNBC interview, Selig stated that the incident “proves our exact point” behind the crypto‑market regulations his agency proposed earlier this month.

The incident also ignited a public exchange between Binance founder Changpeng Zhao (CZ) and Elon Musk. Musk mocked Binance over the hack on X, prompting CZ to retort by highlighting his $500 million investment in Musk’s Twitter takeover, noting, “Our SPCX shares are worth more than a billion. Would appreciate if you show a little support.”

Overall, CZ remained defiant: while the theft is the largest in dollar terms, it is not the biggest in Bitcoin terms, and unlike Mt. Gox or FTX, Binance is covering the entire loss itself. “It hurts, but we survive,” he posted.

Source link