The suspected theft, which occurred on October 29, affected Binance wallets across 10 blockchain networks, including Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger. According to blockchain intelligence firm TRM Labs, approximately $6.36 billion was transferred to attacker-controlled addresses, making it the largest cryptocurrency theft on record. This incident has drawn attention to the security risks surrounding centralised cryptocurrency exchanges and raised questions about how safely billions of dollars in digital assets are held.
Binance’s initial investigation suggests that an attacker may have compromised a DevOps engineer’s laptop, gaining access to a service container through which unauthorised withdrawal transactions were submitted. The exchange said it had found no evidence that its wallet private keys were leaked, although it promised a detailed technical investigation after establishing the full circumstances. Blockchain investigators identified the exploitation of Ethereum’s EIP-7702 account-delegation feature as part of the attack.
The incident has raised questions about the concentration of digital assets in internet-connected hot wallets, which exchanges rely on to process withdrawals quickly. Although such wallets are essential to daily operations, their connection to transaction systems makes them attractive targets for attackers seeking access to large pools of cryptocurrency. The speed at which billions of dollars moved across multiple blockchain networks also exposed the limits of existing safeguards.
Stablecoin issuers Tether and Circle, alongside other blockchain partners, moved to freeze assets linked to the attack. Binance said approximately $3 billion had been frozen on-chain, while TRM Labs estimated the total frozen assets at about $2.7 billion at its October 30 reporting cut-off. Tether reportedly froze approximately $1.77 billion in USDT, while Circle froze about $825 million in USDC.
The attacker also began converting some of the stolen stablecoins into other cryptocurrencies through decentralised trading platforms and lending protocols, complicating efforts to contain the movement of funds. TRM estimated that the attacker retained approximately $2.4 billion in assets, including more than 420,000 Ether and 18,270 Bitcoin, beyond the reach of issuer-led freezing mechanisms.
The breach has raised questions about the strength of Binance’s customer asset backing and the adequacy of reserve disclosures between reporting periods. Binance, however, has assured customers that their funds remain safe and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate funds. Changpeng Zhao, Binance’s co-founder and former chief executive, described the incident as a likely hack and said he expected customers to be fully covered.
Key points
- The breach has exposed a structural weakness in the cryptocurrency industry: the security of decentralised financial assets still depends heavily on the integrity of centralised institutions that hold and move them on behalf of millions of customers.
- TRM Labs has attributed the attack, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking group previously linked to major cryptocurrency thefts.
- The incident places renewed pressure on cryptocurrency exchanges to strengthen transaction authorisation systems, separate operational access from wallet-signing privileges, and improve monitoring across blockchain networks.
