Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History

What it is

Decrypt's account of the theft of about $6.4 billion from Binance hot wallets across roughly 10 blockchains. It began at about 4:05 p.m. ET on a Thursday, and most of the funds moved within about 20 minutes. The page gives no calendar date. Chainalysis and TRM Labs put the total at about $6.4 billion, over four times the February 2025 Bybit theft of $1.5 billion. Both attribute it to TraderTraitor, a North Korean state-linked group also blamed for Bybit.

How it works

Binance first traced the breach to a compromised laptop belonging to a DevOps engineer. That access may have let the attacker reach a service container and submit unauthorized withdrawals. Binance later reported "additional points of breach". CEO Richard Teng said the attack "did not simply use one engineer's permissions". Binance found no evidence that wallet private keys leaked. It says the attacker used a self-destruct mechanism to wipe tooling and traces.

On Ethereum, the attacker used 50 pre-signed EIP-7702 authorizations to turn a Binance hot wallet into a "sweeper" contract. Teng said the delegation "did not pass through our normal approval controls". TRM Labs says this points to a compromise of Binance's signing infrastructure, not a flaw in Ethereum.

Preconditions / Affected

The target was exchange-side infrastructure: hot wallets, a service container that could submit withdrawals, and the signing path. Neither the blockchains nor the wallet keys were reported as the weak point. Customer assets were not touched, according to Binance.

What to do

The page gives no engineering remediation. Binance says it paused withdrawals, is rebuilding and retesting its systems, and is running a full security review. It aims to restore withdrawals by Sunday and publish a full proof of reserves by Monday. The page does not say whether those dates were met. The facts above suggest areas to check in similar setups:

• Whether developer endpoints can reach services that submit withdrawals.
• Whether an EIP-7702 delegation on a hot wallet must pass the same approval controls as a normal transfer.

Caveats

• The root cause is still being investigated, and Binance's account has changed from a single laptop to multiple breach points.
• The existing summary says about $2.3 billion was frozen. The page breaks this down as Tether over $1.5 billion and Circle about $823 million. It also says roughly $3 billion has been frozen or located.
• The attacker still controls more than 420,000 ETH and 18,270 BTC, worth over $3 billion, which no issuer can freeze. Elliptic estimates about $3.3 billion. Funds have moved through Tron and other networks.
• After Bybit, the group converted about 84% of the stolen Ethereum into Bitcoin through Thorchain.
• The FBI confirmed it is aware of the incident. The Secret Service declined to comment.