Cryptocurrency history was rewritten on Thursday afternoon in what has rapidly materialized as the largest and most devastating digital asset theft ever recorded. Attackers successfully drained roughly $6.4 billion from Binance, the world’s largest cryptocurrency exchange by trading volume, in a lightning-fast breach that completely dwarfs every prior security failure in the sector.
The unprecedented scale of the heist has immediately triggered a sprawling, cross-border law enforcement investigation involving top-tier U.S. agencies, a frantic, high-stakes scramble by major stablecoin issuers to freeze compromised funds, and a tense, anxious wait for millions of retail and institutional users worldwide.
What Happened
The coordinated cyberattack began unfolding at approximately 4:05 p.m. Eastern Time on Thursday, just as traditional U.S. financial markets were closing their doors for the day. Within an astonishingly brief window of roughly 20 minutes, malicious actors executed unauthorized withdrawals, systematically moving massive tranches of funds out of Binance hot wallets across approximately 10 different blockchain networks.
Leading blockchain analytics powerhouses Chainalysis and TRM Labs quickly calculated the total value of the stolen assets to be around $6.4 billion. This staggering sum eclipses the previous historic record—February 2025’s $1.5 billion Bybit heist—by more than fourfold, instantly cementing the Binance breach as a watershed moment for digital asset security.
Crucially, initial technical assessments revealed that the attack targeted Binance’s internal corporate infrastructure rather than any vulnerabilities within the underlying blockchains themselves. Binance initially traced the entry point of the breach to a compromised laptop belonging to a DevOps engineer. This compromised workstation allegedly allowed the external attacker to gain unauthorized access to a service container and subsequently submit fraudulent withdrawal requests that bypassed standard operational checks.
However, as the forensic investigation deepened, exchange executives admitted that the situation was far more intricate than a single point of failure. Binance announced that its ongoing internal security review uncovered additional points of breach. Binance CEO Richard Teng described the incident as a significantly more complex attack process that did not simply rely on exploiting one engineer’s administrative permissions. Despite the sophistication of the intrusion, Binance confirmed it has found no evidence indicating that wallet private keys were compromised. The attacker reportedly utilized automated self-destruct mechanisms to systematically wipe internal tooling, log files, and other digital traces along the way to obscure their tracks.
The Ethereum Wrinkle
On the Ethereum blockchain, the perpetrator utilized a novel and highly technical vector, leaning heavily on EIP-7702. This specific feature, which was introduced to the Ethereum ecosystem in 2025, allows ordinary externally owned wallets to temporarily execute smart-contract code during a transaction.
According to forensic evaluations from TRM Labs, the attacker leveraged roughly 50 pre-signed authorizations to instantly transform a standard Binance hot wallet into a specialized "sweeper" contract. Once converted, this contract automatically and rapidly channeled all underlying assets away from the exchange’s control.
CEO Richard Teng emphasized during updates that this specific wave of delegation and authorization routing completely bypassed the exchange’s normal approval controls. Both TRM Labs and Binance reiterated that the episode did not expose an inherent architectural flaw or vulnerability in the Ethereum network itself. Instead, the exploit highlighted a severe compromise within Binance’s internal signing and authorization infrastructure.
Who’s Behind It
It did not take long for the global blockchain intelligence community to reach a consensus regarding the likely perpetrators of the historic theft. Both TRM Labs and Chainalysis publicly attributed the massive Binance hack to TraderTraitor, a notorious cybercrime syndicate linked directly to North Korea’s state-sponsored hacking apparatus. The same malicious collective has previously been blamed by international investigators for other massive crypto thefts, including the aforementioned Bybit heist.
Following that earlier attack, intelligence firms noted that the group systematically laundered roughly 84% of the stolen Ethereum into Bitcoin by routing transactions through cross-chain networks like Thorchain. This latest attribution pushes North Korea’s cumulative crypto theft haul for 2026 well past the $1 billion milestone, with the single Binance breach single-handedly accounting for the vast majority of that grim financial total.
What Binance Is Doing
In an effort to stabilize market confidence and stave off a catastrophic bank run-type scenario, CEO Richard Teng stepped forward immediately to reassure the global user base. Teng announced that Binance will fully cover every single dollar of the missing funds utilizing company reserves alongside its Secure Asset Fund for Users (SAFU), an emergency insurance reserve established specifically for unforeseen black swan events. He firmly stressed that customer assets deposited on the platform were never touched or permanently lost.
To back this promise, Binance swiftly set aside more than $6.34 billion to cover potential hack losses. Approximately $5 billion of that total was already held directly in the exact digital tokens that were stolen—including Bitcoin, Ethereum, Binance Coin, USDC, and USDT—while the exchange began aggressively acquiring the remaining balance across open markets and over-the-counter desks.
To ensure system integrity, Binance temporarily paused all customer withdrawals while engineering teams worked around the clock to rebuild, harden, and rigorously retest their internal signing and security systems. The exchange outlined an ambitious timeline aiming to safely restore full withdrawal capabilities by Sunday, accompanied by the publication of a comprehensive, verifiable proof of reserves report by Monday. Meanwhile, platform deposits continued to operate normally throughout the ordeal.
The Freeze, and What’s Still Loose
Unlike numerous previous security incidents in the history of the cryptocurrency sector, stablecoin issuers reacted with unprecedented speed following the initial reports of the suspected breach.
Stablecoins serve as the critical financial backbone of the modern crypto economy. These are digital tokens explicitly pegged to the U.S. dollar, designed to maintain a stable value of one dollar while enabling frictionless, high-speed trading and settlement across both centralized and decentralized exchanges. Unlike decentralized native cryptocurrencies like Bitcoin or Ethereum, stablecoins are centralized financial instruments issued, managed, and controlled by private corporate entities. This centralized structure grants issuers the unique administrative capability to freeze, block, or blacklist specific digital addresses at any moment and for any reason.
Following the Binance alerts, Tether, the company behind the market-leading USDT stablecoin, swiftly froze more than $1.5 billion in assets tied to the hacker’s addresses. Simultaneously, Circle, the issuer of the second-largest stablecoin, USDC, froze approximately $823 million connected to the attack. Both companies executed these defensive measures by invoking their administrative blacklisting powers.
In total, approximately $3 billion worth of stolen and misdirected funds have been successfully located and frozen by issuers and analytical partners. However, a vastly greater sum remains entirely beyond the reach of law enforcement and corporate intervention. Blockchain security analysts estimate that the attacker still maintains absolute control over more than 420,000 Ether and 18,270 Bitcoins, alongside various other tokens, collectively worth well over $3 billion. These unfreezable assets cannot be locked by any single issuer, and the hacker has continuously shuffled portions of the stolen capital across privacy-friendly platforms and alternative networks like Tron. Security firm Elliptic placed the total value still controlled directly by the hacker at roughly $3.3 billion.
The Investigation
Binance has confirmed that it is actively cooperating with a broad coalition of law enforcement agencies worldwide, most notably the Federal Bureau of Investigation and the U.S. Secret Service.
The FBI officially confirmed that it was fully aware of the ongoing incident and was actively coordinating investigative steps with international and industry partners. The U.S. Secret Service, which maintains specialized jurisdiction over complex financial crimes, digital currency fraud, and network intrusions, declined to provide immediate public comments on the specifics of the active probe.
The unfolding investigation immediately drew parallels to earlier cooperative multi-agency efforts, such as Operation Atlantic earlier in the year, which successfully tracked and recovered tens of millions of dollars in stolen digital assets across international borders.
How Markets Reacted
Considering the mind-boggling monetary scale of the breach, the broader cryptocurrency markets displayed a remarkable degree of composure and resilience.
Bitcoin experienced a moderate downward correction, dipping to approximately $76,400 by Friday morning—representing a relatively modest single-day drop of around 4%. The sudden price volatility triggered the liquidation of more than $1.3 billion in leveraged trading positions across various derivative exchanges.
This muted reaction stands in stark contrast to historical precedents. Market veterans vividly recalled March 2018, when a relatively minor, failed hacking attempt directed at Binance managed to knock nearly 11% off the price of Bitcoin within a matter of minutes. Financial analysts attributed the current market maturity to a vastly larger, more institutionalized asset class now boasting a total valuation of approximately $2.6 trillion. Spot Bitcoin exchange-traded funds, for instance, currently hold roughly 1.3 million Bitcoins in institutional custody hands that are far less prone to instantaneous panic-selling.
Wall Street financial institutions actively leaned into the resilience narrative. Major firms, including Cantor Fitzgerald, TD Cowen, and Compass Point, actually issued advisory notes urging their institutional clients to buy crypto-linked equities and proxies on the weakness. These traditional finance analysts framed the catastrophic event as a localized operational security failure at a single exchange rather than a fundamental technological threat to the underlying public blockchains.
The Fallout
The massive exploit immediately reverberated through the halls of political and regulatory power. CFTC Chairman Michael Selig seized upon the high-profile breach to aggressively argue that offshore cryptocurrency exchanges urgently require direct U.S. regulatory oversight. In an interview with CNBC, Selig asserted that the security failure "proves our exact point" regarding the necessity of the comprehensive crypto-market regulations proposed by his agency earlier in the month.
Simultaneously, the historic event sparked an unexpected public spat on social media between Binance founder Changpeng Zhao—widely known throughout the industry as CZ—and tech billionaire Elon Musk. The SpaceX and Tesla founder appeared to subtly mock Binance over the massive security lapse in a series of posts on the social media platform X. CZ quickly fired back, publicly reminding Musk of his own personal financial ties and a significant SpaceX shareholding resulting from Binance’s prior $500 million financial backing during Musk’s chaotic acquisition of Twitter. "Our SPCX shares are worth more than a billion. Would appreciate if you show a little support," CZ posted publicly.
Overall, CZ maintained a defiant and pragmatic public posture as the crisis unfolded. He acknowledged that while the theft represents the largest single security breach in financial history in nominal dollar terms, it does not surpass historic collapses in terms of total native Bitcoin volume. Furthermore, unlike the disastrous liquidations of legacy platforms like Mt. Gox or FTX years prior, Binance was stepping up to absorb the entire financial loss out of its own pocket.
"It hurts, but we survive," CZ wrote.
Comments (0)