Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History
Binance, the world's largest cryptocurrency exchange, suffered a massive $6.4 billion hack, the largest in crypto history, attributed to North Korean state-linked group TraderTraitor.
Intelligence analysis by Gemini 2.5 Flash
Attackers drained approximately $6.4 billion from Binance's hot wallets across multiple blockchains, leveraging a compromised laptop and complex attack process. While Binance vows to cover all losses using company funds and its emergency reserve, stablecoin issuers froze about $3 billion, but a significant portion remains beyond reach.
Imagine a giant digital bank called Binance, where people keep their special online money. One day, some clever hackers, like digital sneaky pirates, snuck into Binance's back office and stole a huge pile of this digital money, about $6.4 billion worth! It was the biggest digital money heist ever. But don't worry, Binance said they have a special piggy bank set aside and will replace all the stolen money so no one loses theirs. Police are now trying to catch the pirates, who are thought to be from a country called North Korea.
Analysis
TraderTraitor's Modus Operandi
The recent Binance hack, totaling an estimated $6.4 billion, has been attributed by blockchain analytics firms Chainalysis and TRM Labs to TraderTraitor, a North Korean state-linked group. This group was previously implicated in the $1.5 billion Bybit heist in February 2025, demonstrating a pattern of sophisticated attacks targeting major cryptocurrency exchanges. Their methods often involve converting stolen assets, such as Ethereum, into Bitcoin via cross-chain networks like Thorchain, making tracing and recovery more challenging.
The attribution of this hack to TraderTraitor significantly boosts North Korea's estimated crypto haul for 2026, pushing it well past $1 billion. The sheer scale of the Binance theft alone would dwarf all other reported crypto thefts attributed to the nation. This ongoing financial illicit activity underscores the critical need for enhanced cybersecurity measures across the crypto industry and robust international cooperation to combat state-sponsored cybercrime.
The Ethereum Wrinkle and Binance's Infrastructure
The attack on Binance's infrastructure involved a complex process, initially traced to a compromised DevOps engineer's laptop, which allowed attackers to access a service container and submit unauthorized withdrawals. Binance CEO Richard Teng later clarified that the investigation uncovered "additional points of breach," indicating a more intricate attack than initially perceived. Crucially, Binance found no evidence of private key leaks, suggesting the compromise was within their signing infrastructure rather than a fundamental blockchain flaw.
On the Ethereum blockchain, the attackers exploited EIP-7702, a feature introduced in 2025 that enables ordinary wallets to temporarily execute smart-contract code. By using 50 pre-signed authorizations, the attacker transformed a Binance hot wallet into a "sweeper" contract to drain its assets. TRM Labs noted that this delegation bypassed Binance's normal approval controls, pointing to a compromise in the exchange's internal systems rather than a vulnerability in Ethereum itself. The attackers also employed a self-destruct mechanism to erase their tooling and traces, complicating forensic efforts.
Binance's $6.34 Billion Fund and Market Resilience
In response to the unprecedented theft, Binance CEO Richard Teng assured users that the exchange would cover all losses using company funds and its Secure Asset Fund for Users (SAFU), an emergency reserve. The exchange has allocated over $6.34 billion for this purpose, with approximately $5 billion already held in the exact tokens stolen, including BTC, ETH, BNB, USDC, and USDT. Binance is actively acquiring the remaining necessary tokens on the open market and over the counter to ensure full restitution, emphasizing that customer assets were never directly impacted.
Following the incident, stablecoin issuers like Tether and Circle acted swiftly, freezing over $1.5 billion and $823 million respectively, by blacklisting specific addresses linked to the attack. In total, roughly $3 billion of the stolen funds have been frozen or located. However, a substantial sum, estimated at over $3 billion, including 420,000 ETH and 18,270 BTC, remains under the attacker's control and is being shuffled through various networks like Tron. Despite the scale of the hack, crypto markets remained relatively composed, with Bitcoin falling only about 4% to $76,400, a stark contrast to previous incidents. Analysts attribute this resilience to a more mature market, now valued at $2.6 trillion, and the presence of spot Bitcoin ETFs, which hold significant BTC amounts and are less prone to panic selling.
Key points
- Binance suffered a $6.4 billion hack, the largest in crypto history, with funds drained from hot wallets across multiple blockchains.
- The attack is attributed to TraderTraitor, a North Korean state-linked group, which previously conducted the Bybit heist.
- Binance pledged to cover all losses using company funds and its $6.34 billion Secure Asset Fund for Users (SAFU), assuring customer assets were untouched.
- Stablecoin issuers Tether and Circle froze approximately $3 billion in assets linked to the hack, but over $3 billion remains unfrozen.
- Crypto markets, including Bitcoin, showed remarkable resilience, with a relatively minor 4% drop, attributed to a more mature market and institutional involvement.
Binance's commitment to fully cover all losses with its substantial emergency fund and company assets demonstrates a strong dedication to user protection and could reinforce trust in the platform's financial stability. The relatively composed market reaction, despite the hack's scale, suggests a growing maturity and resilience within the broader crypto ecosystem, potentially preventing widespread panic and fostering long-term stability.
Despite Binance's assurances, the fact that over $3 billion of the stolen funds remain unfrozen and under the attacker's control poses a significant risk, as these assets could be laundered and used to fund further illicit activities. The incident also intensifies calls for stricter U.S. oversight on offshore exchanges, potentially leading to more stringent regulations that could impact market operations and innovation.
