Binance Hit by the Largest Crypto Heist on Record: $6.3 Billion Exposed, Nearly Half Frozen

Binance has confirmed a security incident on its platform that touched roughly $6.3 billion in assets, making it the biggest cryptocurrency theft ever recorded. Around $3 billion has already been frozen on-chain, and the exchange says every affected user will be made whole from its emergency reserve and its own balance sheet.

What happened

By Binance's own account, the intrusion appears to have started with a compromised laptop belonging to a DevOps engineer. From that foothold the attacker reached a service container and used it to submit withdrawal transactions that were never authorised. The company stresses that there is no evidence a wallet private key was leaked.

Binance co-CEO Richard Teng has been explicit that this was not a case of a single engineer's permissions being abused in one click. The attack involved a more complex chain of steps, and the exchange has since said its investigation uncovered additional points of breach beyond the laptop. No individual has been blamed, and a formal root-cause report has not yet been published.

In response, the exchange:

• temporarily suspended deposits and withdrawals while security checks are completed;
• revoked the authorisation of the affected address;
• brought in law enforcement and blockchain-intelligence partners to trace and recover the funds.

Withdrawals are expected to resume within about 48 hours, once the withdrawal service and its related addresses have been rebuilt.

How the hot wallet was drained

On-chain reconstruction shows preparation began at least 36 hours before the theft. At 20:20 UTC an attacker-controlled operator address submitted a single transaction carrying 50 authorisations, each signed by the Binance hot wallet and each delegating control to a sweeper contract that only obeys that operator.

The reason for 50 is a detail worth understanding. Every wallet keeps a transaction counter, the nonce, and a signed authorisation is only valid at one exact counter value. Because the Binance hot wallet processes a constant stream of withdrawals, its nonce never stands still. By pre-signing authorisations for 50 consecutive nonces, the attacker guaranteed at least one would line up at execution time. One did.

Three minutes and 24 seconds later, the operator instructed the hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including about 1.615 billion USDT.

The most plausible explanation is that the attacker gained the ability to make Binance's hot-wallet signing system sign transactions of their choosing across several chains. The pre-signed batch hints that the access was time-limited, or that signatures had to be requested through a controlled system rather than taken directly.

Who is behind it

Several blockchain-analytics teams have attributed the operation to North Korea's TraderTraitor cluster with high confidence, the same group tied to the Bybit theft of roughly $1.5 billion in February 2025 and to the KelpDAO incident in April 2026. The hallmarks match: small Tornado Cash withdrawals funding an operator wallet, staging that began long before the theft, and signatures collected in advance and then fired in one burst.

What differs is the laundering. Instead of the bridge-heavy pattern seen after Bybit, the funds are being moved through large swaps via market makers and lending protocols. Funds from last month's Bitget exploit have already been observed mixing with the Binance proceeds. Attribution is strong but still rests on analyst assessment rather than an official statement from Binance, which has not named any party.

Where the money stands

So far Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins, and the Arbitrum Security Council has frozen roughly $30 million in ETH and ARB. The attacker still controls more than 420,000 ETH and 18,270 BTC, worth around $2.4 billion, plus smaller amounts on other chains. The value stolen at the moment of the theft is estimated at about $5.9 billion, nearly four times the next largest heist in the industry's history.

Why it matters

This was not a smart-contract bug. It was an identity-and-endpoint-to-infrastructure chain: one engineer's workstation, one service container, one signing path, and the deepest-pocketed exchange in the world lost control of its hot wallet for a few minutes. Any organisation that runs privileged automation, whether it moves money, signs code or provisions cloud resources, should read this as a warning about its own blast radius.

What to do

• Treat engineering endpoints as production. Hardened builds, EDR, hardware-backed MFA, and no long-lived secrets or signing material on laptops.
• Isolate signing and withdrawal services. Require an independent approval step, enforce velocity and value limits, and alert on batch authorisations or unusual nonce ranges.
• Shrink the blast radius. Short-lived credentials, strict network segmentation between developer tooling and transaction infrastructure, and least privilege on every service account.
• Rehearse the freeze playbook. Know in advance who at each stablecoin issuer, chain security council and exchange you call, and how fast they can act.
• Test the path before an adversary does. Our penetration testing team models exactly this kind of chain, from a single compromised workstation to the systems that move money, so the weak link is found in a controlled exercise rather than in a live incident.