Here We Go Again: Binance Loses $6.3b in Largest Robbery in History

What it is

Galaxy Research's weekly newsletter on the roughly $6.3b drained from Binance across 10 blockchains in one night. TRM Labs and Chainalysis attribute it to TraderTraitor, the Lazarus-linked North Korean unit. Withdrawals were still disabled when the piece was written. The page gives no calendar date, only "Thursday night".

How it works

On Ethereum the attacker used EIP-7702 to make a Binance hot wallet delegate to a sweeper contract that took orders only from the attacker. Because the attacker did not know which transaction number (nonce) would come next, they pre-signed 50 authorizations, one per upcoming nonce, so whichever came next would be valid. The code was rehearsed on three test wallets hours earlier.

Nine more chains were emptied within minutes of each other, using different key types and signing schemes. Galaxy reads this as insider-level knowledge of Binance's withdrawal systems. Binance's preliminary finding is that a compromised DevOps engineer's laptop gave access to a service container, with "no evidence of any wallet private key leak."

Freezes and loss coverage

Issuer freezes: Tether about $1.77b USDT, Circle about $825m USDC, Ripple about $40m RLUSD, World Liberty about $28m USD1. The page also says Circle froze $823m about 40 minutes after the Ethereum sweep, "in coordination with law enforcement". The text gives the freeze total as both $2.5–3bn and, via the issuer figures, about $2.7b.

Circle's stated policy is to freeze only on direction from law enforcement or a court. In the April 2026 Drift exploit ($285m), about $232m of stolen USDC moved through Circle's cross-chain transfer protocol over roughly six hours without a freeze. Galaxy treats Thursday as a break from that pattern.

Binance's SAFU fund holds about $1b in BTC, far short of the loss. Co-CEO Richard Teng said Binance will cover all losses from SAFU and company funds. Galaxy's estimate:

• Net of freezes, the hole is about one year of BNB burns (2026's three quarterly burns so far retired about $3.2bn).
• That is about 4% of the roughly $144bn in assets Binance held before the attack.
• For comparison, last year's 10/10 liquidation event cost under $700m ($283m depeg compensation plus the $400m "Together Initiative").

What to do

The page gives no remediation steps. Its implied lesson, tied to its earlier Bitget thesis, is that attackers go after whatever instructs the signing system, not the key math. For engineers, that points to the build and ops workstations and service containers that can trigger withdrawals. It also points to monitoring for EIP-7702 delegations on hot wallets, though the page does not say so.

Caveats

• Attribution to TraderTraitor comes from TRM Labs and Chainalysis, as reported by Galaxy.
• The laptop compromise is Binance's preliminary finding.
• Galaxy says it cannot independently verify Binance's overall financial condition or its plan.
• About $2.4b in ETH and BTC remained with the attacker. Galaxy lists its next destination (THORChain, Tornado Cash, etc.) and the date withdrawals reopen as open questions.
• The page also covers market impact: BTC held the 50-week moving average ($76,103) against a low of $76,301 on Coinbase. That is a trading note, not security guidance.