Crypto Suffers Record-Breaking $6.4 Billion Hack
The cryptocurrency world is reeling after a massive breach on Thursday saw attackers drain approximately $6.4 billion from Binance, the globe’s largest exchange. The theft, the largest in the history of digital assets, has prompted a cross-border law enforcement investigation, urgent action by stablecoin issuers to freeze funds, and widespread concern among millions of users.
What Transpired
The sophisticated attack commenced around 4:05 p.m. ET on Thursday, shortly after U.S. markets closed. Over a period of roughly 20 minutes, attackers siphoned funds from Binance’s hot wallets across approximately 10 different blockchains. Blockchain analytics firms Chainalysis and TRM Labs have pegged the total value stolen at around $6.4 billion, more than four times the previous record of $1.5 billion in February 2025’s Bybit heist.
Crucially, the breach targeted Binance’s internal infrastructure rather than the blockchains themselves. Initial investigations by Binance pointed to a compromised laptop belonging to a DevOps engineer, which may have granted the attacker access to a service container and enabled unauthorized withdrawals.
However, Binance later revealed that its investigation uncovered “additional points of breach,” with CEO Richard Teng describing a “more complex attack process” that extended beyond a single engineer’s permissions. The exchange stated it found no evidence of wallet private keys being compromised and that the attacker employed a self-destruct mechanism to erase tools and traces during the operation.
The Ethereum Complication
On the Ethereum network, the attacker leveraged EIP-7702, a feature introduced in 2025 that allows standard wallets to temporarily execute smart contract code. According to TRM Labs, the attacker utilized 50 pre-signed authorizations to transform a Binance hot wallet into a “sweeper” contract, subsequently draining its assets.
Teng clarified that this delegation “did not pass through our normal approval controls.” TRM Labs noted that this incident did not expose a vulnerability in Ethereum itself but rather indicated a compromise of Binance’s signing infrastructure.
Identifying the Perpetrators
Both TRM Labs and Chainalysis have attributed the hack to TraderTraitor, a North Korean state-linked group also implicated in the Bybit theft. Following the Bybit attack, the group reportedly converted approximately 84% of the stolen Ethereum into Bitcoin via the cross-chain network Thorchain. This attribution pushes North Korea’s estimated cryptocurrency gains for 2026 well over $1 billion, with the Binance figure alone dwarfing previous totals.
Binance’s Response
Binance has pledged to cover all losses using company funds and its Secure Asset Fund for Users, an emergency reserve, emphasizing that customer assets were not compromised. The exchange has allocated over $6.34 billion for this purpose, with approximately $5 billion already held in the exact tokens that were stolen, including BTC, ETH, BNB, USDC, and USDT. The remaining funds are being acquired on the open market and through over-the-counter transactions.
To facilitate a thorough security review and system rebuild, Binance temporarily paused withdrawals. The exchange aims to restore withdrawal services by Sunday and plans to publish a complete proof of reserves by Monday. Deposits, however, remain operational.
Funds Frozen and Funds at Large
In contrast to previous security incidents, stablecoin issuers acted swiftly following the initial reports of the suspected attack. Stablecoins, which are dollar-pegged tokens designed to maintain a steady value, form the foundation of the crypto economy, enabling seamless transactions across exchanges. Unlike decentralized cryptocurrencies like Bitcoin or Ethereum, stablecoins are issued and managed by private companies, allowing for the potential freezing of funds.
Tether, the issuer of the largest stablecoin, USDT, froze over $1.5 billion in assets. Circle, which issues the second-largest stablecoin, USDC, froze approximately $823 million linked to the attack. Both companies utilized their ability to blacklist specific addresses.
In total, around $3 billion has been frozen or located. However, a substantial sum remains beyond reach. The attacker is estimated to still control over 420,000 ETH and 18,270 BTC, along with other tokens, valued at more than $3 billion. These funds are currently being shuffled through Tron and other networks, making them inaccessible to issuers. Security firm Elliptic estimates the hacker still holds approximately $3.3 billion.
The Investigation Underway
Binance is actively cooperating with law enforcement agencies globally, including the FBI and the U.S. Secret Service. The FBI has confirmed its awareness of the incident and its coordination with international partners. The Secret Service, which investigates financial and digital currency crimes, declined to comment. This investigation echoes previous joint efforts, such as Operation Atlantic in April, which successfully traced tens of millions in stolen cryptocurrency.
Market Reaction
Despite the unprecedented scale of the theft, cryptocurrency markets demonstrated remarkable composure. Bitcoin saw a modest decline to around $76,400 on Friday, a drop of roughly 4%, leading to the liquidation of over $1.3 billion in leveraged positions. This contrasts sharply with March 2018, when a failed attack on Binance caused Bitcoin’s value to plummet by nearly 11% in minutes. Analysts attribute the current stability to a larger, more mature market, now valued at approximately $2.6 trillion, with spot Bitcoin ETFs holding substantial amounts of BTC, mitigating panic selling.
Wall Street firms, including Cantor Fitzgerald, TD Cowen, and Compass Point, even advised clients to purchase crypto-linked stocks amidst the weakness, framing the hack as a specific security failure by Binance rather than a threat to the underlying blockchain technology.
Broader Implications
CFTC Chairman Michael Selig used the breach to advocate for U.S. oversight of offshore cryptocurrency exchanges. In an interview with CNBC, Selig stated that the incident “proves our exact point” regarding the crypto-market regulations the agency proposed earlier this month.
The episode also ignited a public exchange between Binance founder Changpeng Zhao, widely known as CZ, and Elon Musk. Musk appeared to taunt Binance about the hack on X, prompting a retort from CZ, who referenced Musk’s own SpaceX stake. “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support,” CZ posted.
Overall, CZ maintained a defiant stance, acknowledging the theft as the largest in dollar terms but not in Bitcoin terms. He emphasized that, unlike previous major collapses such as Mt. Gox or FTX, Binance is absorbing the financial loss itself. “It hurts, but we survive,” he wrote.
