Binance Hack: How Attackers Drained a Record $6.3 Billion

Hackers stole roughly $6.3 billion from Binance on Thursday, the largest cryptocurrency theft on record, and the exchange has committed more than $6.34 billion of company funds to cover the losses.

On-chain investigators attributed the breach to North Korea-backed hackers, matching the pattern of Bybit's $1.5 billion loss in February 2025 and September's Bitget breach. Binance said it holds $5 billion of the reimbursement reserve in the same tokens stolen in the attack.

By Friday morning, investigators had identified additional breach points beyond the initially suspected compromised laptop of an engineer. Binance co-CEO Richard Teng said: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. Our investigation has not attributed responsibility to any individual."

How did the attackers execute the theft?

The exploit has put Ethereum's EIP-7702 upgrade under scrutiny. Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, bypassing Binance's normal approval controls.

Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft. He added that attackers could have stolen the funds without EIP-7702, but the delegation mechanism may have helped them bypass safeguards and drain assets in a single sweep.

A "self-destruct mechanism" destroyed tools and traces after the theft, Teng said, complicating the investigation. Chainalysis observed thousands of transactions in quick succession that could indicate automated laundering, with funds circulating among addresses and sometimes returning to wallets used earlier.

What is the operational fallout?

The theft rattled crypto prices and triggered a precautionary freeze on new deposits and borrowing at decentralized lender Aave. Aave reopened its markets Friday afternoon.

Binance's withdrawals remained suspended as of Friday. Teng said the exchange was rebuilding its withdrawal service and conducting a company-wide security review.

Binance set two deadlines for itself:

• Resume withdrawals within 40 hours of Teng's Friday update
• Publish a full proof-of-reserves report by Monday

The reimbursement pledge of $6.34 billion exceeds the stolen amount, and the $5 billion token-matched portion is designed to let the exchange repay users in the same assets they held rather than in cash equivalents.

The breach is now the benchmark against which future exchange security failures will be measured — nearly four times the size of Bybit's February 2025 loss, which previously held the record. Attribution to a North Korea-linked group places the incident within a documented pattern of state-sponsored attacks on crypto infrastructure rather than an isolated internal failure.

What happens next?

The 40-hour withdrawal window and the Monday proof-of-reserves report are the immediate tests of Binance's recovery plan. Beyond those deadlines, the role of EIP-7702 in the attack is likely to draw sharper scrutiny from protocol developers and exchanges reviewing their hot-wallet approval architectures.