Binance Hit by Record $6 Billion Crypto Heist
Cryptocurrency exchange Binance faces the largest crypto heist in history after hackers siphoned roughly $6.3 billion across ten blockchains in a meticulously planned operation.
Radwan AbdulhadiEditor and technology writer
The Largest Crypto Heist in History
Binance, the world’s largest cryptocurrency exchange, has experienced the biggest crypto heist ever recorded after hackers moved over $6 billion out of its platform wallets. According to blockchain intelligence calculations by TRM Labs, approximately $6.36 billion was siphoned from Binance wallets across ten blockchains on October 29, with the vast majority of the funds leaving the platform within roughly 20 minutes.
The massive scale of this attack completely dwarfs previous industry records, such as the $1.5 billion taken from Bybit in February 2025. In response to the breach, Binance quickly halted all withdrawals and pledged to fully reimburse all user losses using company funds alongside its Secure Asset Fund for Users (SAFU).
Initial Findings and Attack Vector
Binance's early internal findings indicate that the intrusion may have originated from an employee's workstation. In an official communication, Binance stated that preliminary investigations point toward a compromised DevOps engineer's laptop, which allegedly granted an attacker access to a service container capable of submitting unauthorized withdrawal transactions.
Despite the unauthorized access, exchange representatives confirmed that their investigation has uncovered no evidence of any wallet private key leak. TRM Labs reported that the attackers spent at least a day and a half preparing for the operation, funding the primary wallet through small Tornado Cash withdrawals and testing malicious code on other wallets before launching the live attack.
Sophisticated Cross-Chain Execution
On the Ethereum blockchain, the perpetrators utilized EIP-7702, a protocol mechanism allowing standard wallets to delegate behavior to smart contracts via signed permissions. The hackers transmitted a batch of 50 pre-signed permissions from a Binance hot wallet to ensure one would match the exact transaction count at execution, successfully delegating the hot wallet to an attacker-controlled contract.
While the Ethereum portion initially resembled phishing activity, that hypothesis failed to explain concurrent outflows across nine other blockchains where Binance wallets transmitted funds via regular, validly signed transactions. TRM noted that these diverse chains, key types, and signing schemes all produced valid signatures within half an hour, implying the attackers compromised Binance's hot wallet signing system directly.
Attribution to North Korean Hackers
Multiple cybersecurity researchers and blockchain firms have pointed directly toward state-sponsored actors in North Korea. TRM Labs attributed the operation with high confidence to TraderTraitor, North Korea’s elite hacking unit, citing robust on-chain and off-chain intelligence connecting the incident to past events like the KelpDAO hack.
Additional industry analysts echoed these assessments. Chainalysis CEO Jonathan Levin indicated that his firm also views TraderTraitor as the likely perpetrator, noting direct links between funds from this event and an earlier Bitget exploit. Meanwhile, prominent blockchain investigator ZachXBT also named the Lazarus Group as the probable attacker behind the historic breach.
Asset Freezing and Ongoing Fallout
Major stablecoin issuers moved swiftly to mitigate the damage. By the early hours of October 30, TRM reported approximately $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle. Binance estimated the total frozen amount at approximately $3 billion as emergency protocols took effect.
To bypass issuer freezes, the hackers aggressively traded stolen USDT for ETH at steep discounts exceeding 10% below market value. According to blockchain data, the threat actors retain over 420,000 ETH and 18,270 BTC—amounting to roughly $2.4 billion in assets that cannot be frozen by central issuers.
Sources
- SecurityWeek$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Continue chronologically
Related stories
FBI Attributes Record $6.3B Binance Heist to North Korea
The FBI confirms North Korean hackers TraderTraitor carried out the $6.3 billion Binance crypto theft, marking the largest cryptocurrency heist ever.
Binance Hit by Record $6.3 Billion Crypto Heist
Cryptocurrency exchange Binance faces a record $6.3 billion hack as blockchain firms freeze billions and investigators trace the complex attack.
FBI Flags Over 600 Addresses Tied to North Korea Binance Heist
The FBI flags over 600 crypto addresses linked to North Korean state-sponsored hackers following the record-breaking Binance breach.
Hackers Steal $6.3 Billion From Binance in Record Crypto Heist
Cryptocurrency exchange Binance suspends withdrawals following a record-breaking $6.3 billion hack linked by analysts to North Korea.
