The Binance Crypto Hack: Scale, Response, and Unresolved Questions

Highlights

Attackers stole roughly $6.4 billion from Binance on Thursday, making the incident the largest crypto heist reported and exceeding February 2025’s $1.5 billion Bybit theft by more than four times. The breach targeted Binance’s infrastructure, not the underlying blockchains. Binance says it will cover losses using company funds and its Secure Asset Fund for Users, with more than $6.34 billion set aside. Stablecoin issuers froze or located roughly $3 billion, but the attacker reportedly retains large quantities of cryptocurrency. The incident highlights how exchange security, asset recovery, and cross-border enforcement can shape the consequences of a crypto breach.

Sentiment Analysis

• Overall tone: The article is predominantly serious and cautionary, reflecting the unprecedented reported scale of the theft and the operational disruption at a major exchange.
• Negative elements: The reported loss, withdrawal pause, compromised infrastructure, and substantial funds still beyond reach create a clear sense of risk. The mention of a suspected North Korean state-linked group and the complexity of tracing transfers add to the security concerns.
• Neutral elements: Much of the account is factual and attributed to Binance, analytics firms, law-enforcement agencies, and market observers. It distinguishes an exchange infrastructure compromise from a defect in the blockchains themselves.
• Positive or reassuring elements: Binance says customer assets were not touched and that it will cover losses. Stablecoin issuers froze or located funds, and investigators are cooperating across jurisdictions. Market reaction was described as relatively composed.
• Assessment: The balance is mixed but leans negative because the incident’s scale and unresolved recovery dominate, despite response measures and market resilience.

Article Text

On Thursday, attackers stole roughly $6.4 billion from Binance, the world’s largest cryptocurrency exchange, in what the source describes as the largest crypto theft in history. The breach set off a response involving the exchange, blockchain analytics firms, stablecoin issuers, and law-enforcement agencies in multiple jurisdictions. The event also prompted attention from investors and public officials, while leaving a significant amount of cryptocurrency outside the reach of immediate recovery efforts.

The theft reportedly began at about 4:05 p.m. ET, after U.S. markets had closed. Attackers moved assets from Binance hot wallets across roughly 10 blockchains, with most of the activity taking place within about 20 minutes. Chainalysis and TRM Labs estimated the total at around $6.4 billion. That figure is more than four times the previous record cited in the account: the $1.5 billion Bybit heist in February 2025.

Binance’s initial account linked the breach to a compromised laptop belonging to a DevOps engineer. The compromise may have enabled access to a service container and the submission of unauthorized withdrawals. Binance later said its investigation had identified “additional points of breach.” CEO Richard Teng characterized the operation as a more complex process than the use of one engineer’s permissions. The exchange said it found no evidence that wallet private keys had been leaked and reported that the attacker used a self-destruct mechanism to erase tools and traces.

A notable part of the incident involved Ethereum. According to TRM Labs, the attacker used 50 pre-signed authorizations and EIP-7702, a feature introduced in 2025 that allows ordinary wallets to run smart-contract code temporarily. The technique reportedly turned a Binance hot wallet into a “sweeper” contract that could move its assets. Teng said the delegation did not pass through Binance’s normal approval controls. TRM’s assessment was that the episode pointed to a compromise of Binance’s signing infrastructure, rather than a flaw in Ethereum itself.

TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state-linked group also blamed for the Bybit incident. Following that earlier theft, the group reportedly converted roughly 84% of the stolen Ethereum into Bitcoin through the cross-chain network Thorchain. The source says the attribution places North Korea’s 2026 crypto haul well past $1 billion, with the Binance figure alone exceeding the rest described there.

Binance says it will cover every dollar of the losses through company funds and its Secure Asset Fund for Users, an emergency reserve. The exchange says customer assets were never touched. It has set aside more than $6.34 billion, including about $5 billion already held in the exact tokens stolen, such as BTC, ETH, BNB, USDC, and USDT. It is buying the remainder on the open market and over the counter. Binance paused withdrawals to rebuild and retest systems, began a full security review, and aimed to restore withdrawals by Sunday and publish a complete proof of reserves by Monday. Deposits were reported to be operating normally.

Stablecoin issuers acted to restrict some of the funds. The source explains that stablecoins are dollar-pegged tokens used for transactions and are centrally issued and managed by private companies. Their issuers can blacklist addresses and freeze assets. Tether froze more than $1.5 billion in assets, while Circle froze around $823 million tied to the attack. Overall, roughly $3 billion had been frozen or located. However, the attacker was still reported to control more than 420,000 ETH and 18,270 BTC, plus other tokens, worth over $3 billion. The funds continued to move through Tron and other networks, and Elliptic estimated that around $3.3 billion remained under the hacker’s control.

Binance is cooperating with law enforcement worldwide, including the FBI and the U.S. Secret Service. The FBI confirmed awareness of the incident and coordination with partners; the Secret Service declined to comment. The investigation echoes earlier joint efforts, including April’s Operation Atlantic, which traced tens of millions in stolen crypto.

Markets appeared relatively composed given the reported scale. Bitcoin fell to about $76,400 on Friday, down roughly 4%, while more than $1.3 billion in leveraged positions were liquidated. The source contrasts this with March 2018, when a failed attack on Binance knocked nearly 11% off Bitcoin in minutes. Analysts cited a larger market, then worth around $2.6 trillion, and spot Bitcoin ETFs holding roughly 1.3 million BTC as factors behind the more restrained response. Cantor Fitzgerald, TD Cowen, and Compass Point urged clients to buy crypto-linked stocks amid the weakness, presenting the event as a Binance security failure rather than a threat to the underlying technology.

The breach also entered policy and public debate. CFTC Chairman Michael Selig argued that offshore exchanges need U.S. oversight, saying in an interview with CNBC that the breach “proves our exact point” about proposed crypto-market regulations. Binance founder Changpeng Zhao, known as CZ, and Elon Musk exchanged public remarks on X. CZ referred to SpaceX shares from a $500m investment in Musk’s Twitter takeover and said they were worth more than a billion. He argued that the theft was the largest in dollar terms, but not in Bitcoin terms, and contrasted Binance’s response with Mt. Gox and FTX. The central unresolved issue is that compensation and frozen assets do not by themselves recover the funds that remain under the attacker’s control.

Key Insights Table