Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History

Crypto just suffered the largest hack in its history.

On Thursday, attackers drained roughly $6.4 billion from Binance, the world’s largest cryptocurrency exchange, in a breach that dwarfs every theft before it and has triggered a cross-border law-enforcement investigation, a scramble by stablecoin issuers to freeze funds, and a tense wait for millions of users.

Here’s what’s known about the Binance hack so far.

What happened

The theft began at about 4:05 p.m. ET on Thursday, after U.S. markets had closed, when attackers moved funds out of Binance hot wallets across roughly 10 blockchains, most of it within about 20 minutes.

Blockchain analytics firms Chainalysis and TRM Labs put the total at around $6.4 billion, more than four times the previous record, February 2025’s $1.5 billion Bybit heist.

Crucially, the attack targeted Binance’s own infrastructure, not the blockchains themselves. Binance initially traced the breach to a compromised laptop belonging to a DevOps engineer, which may have let the attacker reach a service container and submit unauthorized withdrawals.

The exchange has since said its investigation uncovered “additional points of breach,” with CEO Richard Teng describing “a more complex attack process” that “did not simply use one engineer’s permissions.” Binance said it found no evidence that wallet private keys were leaked, and that the attacker used a self-destruct mechanism to wipe tooling and traces along the way.

The Ethereum wrinkle

On Ethereum, the attacker leaned on EIP-7702, a feature introduced in 2025 that lets ordinary wallets temporarily run smart-contract code.

Using 50 pre-signed authorizations, the attacker turned a Binance hot wallet into a “sweeper” contract and drained its assets, according to TRM Labs.

Teng said that delegation “did not pass through our normal approval controls.” The episode didn’t expose a flaw in Ethereum itself, but rather, TRM said, pointed to a compromise of Binance’s signing infrastructure.

Who’s behind it

TRM Labs and Chainalysis both attributed the hack to TraderTraitor, a North Korean state-linked group also blamed for the Bybit heist.

After that attack, the group converted roughly 84% of the stolen Ethereum into Bitcoin via the cross-chain network Thorchain. The attribution pushes North Korea’s 2026 crypto haul well past $1 billion, and the Binance figure alone would dwarf the rest.

What Binance is doing

Teng said Binance will cover every dollar of the losses with company funds and its Secure Asset Fund for Users, an emergency reserve, stressing that customer assets were never touched.

The exchange has set aside more than $6.34 billion, about $5 billion of it already held in the exact tokens stolen, including BTC, ETH, BNB, USDC, and USDT, and is buying the rest on the open market and over the counter.

Binance paused withdrawals to rebuild and retest its systems, is running a full security review, and aims to restore withdrawals by Sunday while publishing a complete proof of reserves by Monday. Deposits are operating normally.

The freeze, and what’s still loose

Stablecoin issuers moved fast following the initial reports of a suspected attack, unlike previous security incidents.

Stablecoins are the backbone of the crypto economy—dollar-pegged tokens designed to hold a steady value that enable quick and easy transactions on both centralized and decentralized exchanges. Unlike traditional digital currencies, like Bitcoin or Ethereum, stablecoins are centralized, issued and managed by private companies. That means these funds can be frozen at any time, and for any reason.

Tether, the company behind the biggest stablecoin on the market USDT, froze more than $1.5 billion in assets. Circle, which issues the second largest stablecoin USDC, froze around $823 million tied to the attack, both using their ability to blacklist specific addresses.

In all, roughly $3 billion has been frozen or located. But a large sum remains beyond reach: the attacker still controls more than 420,000 ETH and 18,270 BTC, plus other tokens, worth over $3 billion that no issuer can freeze, and has kept shuffling funds through Tron and other networks. Security firm Elliptic estimated the hacker still controls around $3.3 billion.

The investigation

Binance is cooperating with law enforcement worldwide, including the FBI and the U.S. Secret Service.

The FBI confirmed it was aware of the incident and coordinating with partners; the Secret Service, which investigates financial and digital-currency crimes, declined to comment.

It echoes earlier joint efforts like April’s Operation Atlantic, which traced tens of millions in stolen crypto.

How markets reacted

For a theft of this scale, markets stayed remarkably composed.

Bitcoin fell to about $76,400 on Friday, down roughly 4%, and more than $1.3 billion in leveraged positions were liquidated.

That’s a far cry from March 2018, when a failed attack on Binance knocked nearly 11% off Bitcoin in minutes. Analysts credit a bigger, more mature market, now worth around $2.6 trillion, with spot Bitcoin ETFs holding roughly 1.3 million BTC in hands that don’t panic-sell.

Wall Street firms including Cantor Fitzgerald, TD Cowen, and Compass Point even urged clients to buy crypto-linked stocks on the weakness, framing the hack as a Binance security failure rather than a threat to the underlying technology.

The fallout

CFTC Chairman Michael Selig seized on the breach to argue offshore exchanges need U.S. oversight. Selig said in an interview with CNBC that the breach “proves our exact point” behind the crypto-market regulations the agency proposed earlier this month.

And the episode sparked a public spat between Binance founder Changpeng Zhao, better known as CZ, and Elon Musk. The SpaceX and Tesla founder appeared to troll Binance over the hack on X, and CZ fired back, citing Musk’s own SpaceX stake. “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support,” CZ posted.

CZ struck a defiant note overall: the theft is the largest in dollar terms, he said, but not in Bitcoin terms, and unlike Mt. Gox or FTX, Binance is absorbing the loss itself.

“It hurts, but we survive,” he wrote.