Binance says it will cover every dollar lost in Thursday’s hack, which it now estimates at about $6.3 billion, making it the largest crypto theft on record.
The exchange has reserved more than $6.34 billion of its own company funds to cover the losses. About $5 billion of that is already held in the same tokens that were stolen, and Binance says it is buying the rest through the market and over-the-counter desks.
Chief executive Richard Teng told customers their “money is safe,” and that Binance is “covering every loss.” He said customer funds were not touched, because the attack hit Binance’s own hot wallets, the internet-connected wallets used for day-to-day withdrawals, while most user assets are held in offline cold storage.
How big was it
Estimates from blockchain analytics firms are close to Binance’s own. TRM Labs puts the theft at about $6.36 billion, Chainalysis at about $6.4 billion and Arkham at $6.01 billion.
Both TRM and Chainalysis call it the largest crypto theft on record. At around four times the size of the roughly $1.5 billion Bybit hack in February 2025, it far exceeds the previous record.
Most of the funds left Binance wallets across about 10 blockchains in roughly 20 minutes, starting at around 4:05pm Eastern Time on Thursday, according to TRM.
How the attackers got in
Binance first said its investigation began with a compromised laptop belonging to a DevOps engineer, which may have given the attacker access to a service that could submit unauthorised withdrawals.
It has since said the investigation “has uncovered additional points of breach,” describing it as “a complex attack.” Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” Binance said it found no evidence that any wallet private keys had leaked.
TRM said that on Ethereum, the attacker used an EIP-7702 delegation, a feature that lets a wallet run delegated code, to turn a Binance hot wallet into a sweeper, backed by 50 pre-signed authorisations. On the other chains, funds left through ordinary signed transfers, which TRM read as a compromise of Binance’s hot wallet signing systems.
Binance plans to publish a full technical post-mortem.
Who is behind it
TRM Labs and Chainalysis both attribute the attack to TraderTraitor, the North Korean hacking group the FBI linked to the Bybit hack. TRM said it reached that conclusion “with high confidence,” based on on-chain and off-chain intelligence.
Both firms said the wallet used to set up the attack was funded through crypto mixer Tornado Cash. Chainalysis said it saw stolen Binance funds mixing in real time with proceeds from last month’s Bitget exploit, which was also attributed to North Korea. TRM said the methods matched earlier North Korea-linked attacks.
Binance itself had not attributed the attack to anyone at the time of writing. North Korea has previously denied involvement in hacking.
The race to freeze funds
Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB. Binance puts the total frozen at about $3 billion.
The attacker moved quickly to swap stablecoins, which issuers can freeze, into Ether and Bitcoin, which no issuer can. TRM said the attacker sold USDT to market makers and borrowed Ether against USDT on lending protocol Aave. Chainalysis described “never-seen-before laundering patterns.”
According to TRM, the attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion and beyond the reach of any freeze.
Withdrawals and what happens next
Deposits have reopened, but withdrawals remain suspended while Binance rebuilds and retests its withdrawal systems. The exchange aims to restore them by Sunday.
Binance says it will publish an updated proof of reserves by Monday. Those two steps, withdrawals reopening and the reserves report, will be the clearest test of its promise that customers are not out of pocket.
