Binance hack: $6.4 billion stolen, withdrawals paused until Sunday

Attackers took roughly $6.4 billion from Binance hot wallets on Thursday, according to Decrypt · Crypto news. The theft started around 4:05 p.m. ET, after U.S. markets closed. Funds moved out across about 10 blockchains, most of it within roughly 20 minutes.

Chainalysis and TRM Labs put the total near $6.4 billion. That is more than four times the previous record, the $1.5 billion Bybit heist of February 2025. The attack hit Binance's own infrastructure, not the blockchains themselves.

Binance first traced the breach to a compromised laptop belonging to a DevOps engineer. That may have let the attacker reach a service container and submit unauthorized withdrawals.

CEO Richard Teng later described a more complex attack process that did not rely on one engineer's permissions. Binance said its investigation found additional points of breach. The exchange also said it found no evidence that wallet private keys leaked, and that the attacker used a self-destruct mechanism to wipe tooling and traces.

On Ethereum, the attacker used EIP-7702, a feature introduced in 2025 that lets ordinary wallets temporarily run smart-contract code. With 50 pre-signed authorizations, the attacker turned a Binance hot wallet into a sweeper contract and drained its assets, according to TRM Labs.

Teng said that delegation did not pass through Binance's normal approval controls. TRM said the episode pointed to a compromise of Binance's signing infrastructure, not a flaw in Ethereum itself.

TRM Labs and Chainalysis both attributed the hack to TraderTraitor, a North Korean state-linked group also blamed for the Bybit heist. After that earlier attack, the group converted roughly 84% of the stolen Ethereum into Bitcoin through Thorchain.

Stablecoin issuers moved fast after the first reports, unlike in previous incidents. Tether, the company behind the largest stablecoin, is among them. Stablecoins are centralized, so issuers can freeze funds at any time and for any reason.

Teng said Binance will cover every dollar of the losses with company funds and its Secure Asset Fund for Users, an emergency reserve. He stressed that customer assets were never touched.

The exchange has set aside more than $6.34 billion. About $5 billion of that is already held in the exact tokens stolen, including BTC, ETH, BNB, USDC and USDT. Binance is buying the rest on the open market and over the counter.

Withdrawals are paused while Binance rebuilds and retests its systems. The exchange aims to restore withdrawals by Sunday and publish a full proof of reserves by Monday. Deposits are operating normally.