Crypto has just suffered the largest and most devastating hack in its history. In a breach that fundamentally challenges assumptions around digital asset security and exchange resilience, attackers managed to drain roughly $6.4 billion from Binance, the world’s largest cryptocurrency exchange.
The catastrophic security failure unfolded rapidly on Thursday, instantly dwarfing every single digital asset theft that came before it. The sheer scale of the incident has triggered an aggressive cross-border law enforcement investigation, a frantic race by stablecoin issuers to blacklist and freeze stolen funds, and an anxious, tense wait for millions of retail and institutional users worldwide. As the global crypto community processes the unprecedented magnitude of the breach, a clearer picture has begun to emerge regarding how the attack was executed, who is suspected to be behind it, and how the broader market is responding to the fallout.
What Happened
The devastating theft began at approximately 4:05 p.m. ET on Thursday, strategically timed just after traditional U.S. markets had closed for the day. Over the course of a frantic twenty-minute window, attackers systematically moved vast amounts of funds out of Binance hot wallets spanning roughly ten different blockchains.
Leading blockchain analytics firms Chainalysis and TRM Labs quickly calculated the total stolen bounty at around $6.4 billion. To put that staggering figure into perspective, it is more than four times larger than the previous record-shattering heist—the $1.5 billion Bybit breach that occurred in February 2025.
Crucially, forensic analysis revealed that the attack targeted Binance’s internal infrastructure rather than exploiting underlying vulnerabilities in the various blockchains themselves. Binance initially traced the entry point of the breach to a compromised laptop belonging to a DevOps engineer, an oversight that appears to have allowed the attacker to reach an internal service container and submit a series of unauthorized withdrawals.
However, as the investigation deepened, exchange executives admitted that the situation was far more severe. Binance subsequently announced that its security teams had uncovered additional points of breach. CEO Richard Teng described the incident as a much more complex attack process that did not simply rely on exploiting one single engineer’s permissions. Notably, Binance reported finding no evidence that wallet private keys were leaked; instead, the sophisticated attacker utilized an internal self-destruct mechanism to wipe out administrative tooling and erase tracking traces as they moved through the system.
The Ethereum Wrinkle
On the Ethereum network, the attacker utilized a relatively recent and advanced mechanism known as EIP-7702, a protocol feature introduced in 2025 that allows ordinary externally owned wallets to temporarily execute smart-contract code during a transaction.
According to TRM Labs, the attacker leveraged roughly 50 pre-signed authorizations to instantly transform a Binance hot wallet into a malicious "sweeper" contract, enabling them to rapidly siphon off and drain its entire asset balance.
Teng acknowledged that this critical delegation of authority bypassed the exchange’s normal, rigorous approval controls. Security experts emphasize that the episode did not expose an inherent flaw in the Ethereum blockchain itself. Rather, as TRM Labs pointed out, it pointed directly to a profound compromise of Binance’s internal signing and authorization infrastructure.
Who’s Behind It
It did not take long for premier blockchain intelligence firms to point fingers at a familiar state-sponsored actor. Both TRM Labs and Chainalysis formally attributed the massive $6.4 billion hack to TraderTraitor, a notorious North Korean state-linked cybercrime collective. The same group has previously been blamed by international investigators for other massive digital heists, including the aforementioned Bybit attack.
According to ongoing blockchain tracking, following previous major thefts, the group has historically converted large percentages of stolen assets—such as roughly 84% of stolen Ethereum—into Bitcoin by routing funds through cross-chain networks like Thorchain. This latest attribution pushes North Korea’s cumulative crypto haul for the year 2026 well past the $1 billion mark, with the Binance figure alone single-handedly eclipsing all previous historical tallies combined.
What Binance Is Doing
In an effort to stave off catastrophic panic and maintain user trust, CEO Richard Teng announced that Binance will personally cover every single dollar of the losses using company funds alongside its Secure Asset Fund for Users (SAFU), an emergency financial reserve set aside precisely for catastrophic contingencies. Teng heavily stressed that customer assets were never compromised or permanently lost.
To back up this promise, Binance quickly set aside more than $6.34 billion to cover potential hack liabilities. Approximately $5 billion of that reserve was already held in the exact same tokens that were stolen, including Bitcoin, Ethereum, BNB, USDC, and USDT, while the exchange actively acquired the remaining balance through open-market and over-the-counter purchases.
To ensure system integrity, Binance immediately paused all withdrawals in order to completely rebuild, overhaul, and rigorously retest its security architecture. The exchange instituted a comprehensive security review with the goal of restoring normal withdrawal operations by Sunday, alongside plans to publish a complete and verified proof of reserves by Monday. Meanwhile, platform deposits continued to operate normally throughout the ordeal.
The Freeze, and What’s Still Loose
Unlike previous major security incidents in the crypto space, stablecoin issuers moved with unprecedented speed following the initial reports of the breach.
Stablecoins serve as the absolute financial backbone of the modern cryptocurrency economy. These dollar-pegged digital tokens are designed to maintain a stable, predictable value, enabling fast, frictionless transactions across both centralized trading platforms and decentralized finance protocols. Unlike native, decentralized digital currencies like Bitcoin or Ethereum, stablecoins are centralized assets issued, managed, and controlled by private corporate entities. This structural design grants issuers the absolute authority to blacklist specific digital addresses and freeze funds at any moment for any reason.
Tether, the company behind USDT, the largest stablecoin on the market, moved swiftly to freeze more than $1.5 billion in tainted assets. Simultaneously, Circle, the issuer of the second-largest stablecoin, USDC, froze approximately $823 million tied directly to the attack addresses. Both companies utilized their administrative blacklisting capabilities to lock down the funds.
In total, roughly $3 billion worth of stolen assets has been successfully frozen or located. However, a massive fortune remains completely beyond the reach of law enforcement and corporate issuers. The hacker still maintains control over more than 420,000 ETH, 18,270 BTC, and various other tokens collectively worth over $3 billion that cannot be frozen by any centralized issuer. The attacker has continued shuffling these unfreezeable funds through privacy-enhancing networks and alternative chains like Tron. Security analytics firm Elliptic estimated that the rogue actor still actively controls roughly $3.3 billion in loose cryptocurrency.
The Investigation
In the wake of the breach, Binance has mobilized to cooperate fully with international law enforcement agencies across the globe, most notably the Federal Bureau of Investigation and the U.S. Secret Service.
The FBI formally confirmed that it was fully aware of the unprecedented cyber incident and was actively coordinating with domestic and international partners. Meanwhile, the U.S. Secret Service, which holds jurisdiction over major financial and digital-currency crimes, declined to comment publicly on the ongoing probe.
The multi-agency response echoes earlier joint international operations, such as April’s Operation Atlantic, which successfully tracked down tens of millions of dollars in stolen cryptocurrency across foreign jurisdictions.
How Markets Reacted
Given the historic, jaw-dropping scale of a $6.4 billion theft, financial markets displayed a remarkably high degree of composure, avoiding the catastrophic contagion that many analysts initially feared.
Bitcoin experienced a moderate dip, falling to roughly $76,400 on Friday—a decline of about 4%—which triggered the liquidation of more than $1.3 billion in over-leveraged trading positions.
This muted reaction stands in stark contrast to historical precedents, such as a failed hack attempt on Binance in March 2018 that abruptly knocked nearly 11% off the price of Bitcoin within minutes. Market analysts attribute this newfound resilience to a much larger, more mature digital asset ecosystem boasting a total valuation of around $2.6 trillion. Furthermore, institutional adoption via spot Bitcoin ETFs—which currently hold roughly 1.3 million BTC in institutional hands—has created a stabilizing base of investors who are far less prone to panic selling during black-swan events.
Wall Street financial institutions, including Cantor Fitzgerald, TD Cowen, and Compass Point, even went as far as urging their institutional clients to buy crypto-linked equities on the market weakness. Wall Street analysts largely framed the incident as a localized corporate security failure at Binance rather than a fundamental threat to the underlying blockchain technology.
The Fallout
The disaster immediately became a political and regulatory flashpoint. CFTC Chairman Michael Selig seized upon the massive breach to argue fiercely that offshore cryptocurrency exchanges desperately need direct U.S. regulatory oversight. In a CNBC interview, Selig asserted that the devastating breach "proves our exact point" regarding the necessity of the stringent crypto-market regulations proposed by the agency earlier in the month.
The episode also sparked an unexpected public clash on social media between Binance founder Changpeng Zhao, widely known as CZ, and billionaire tech mogul Elon Musk. The SpaceX and Tesla founder appeared to publicly mock Binance over the hack on the social media platform X. CZ fired back by drawing attention to Musk’s own financial ties, reminding him of a past corporate investment.
"Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support," CZ posted publicly.
Overall, CZ maintained a defiant and pragmatic tone regarding the crisis. He pointed out that while the theft is undeniably the largest in nominal dollar terms, it does not rank as the largest in Bitcoin terms, and unlike legacy disasters like Mt. Gox or FTX, Binance is fully absorbing the financial blow out of its own pocket rather than passing losses onto users.
"It hurts, but we survive," he wrote.
Decentralized Applications (dApps)
Decentralized Applications (dApps)
Decentralized Applications (dApps)
