Binance's $6.3 Billion Heist Forces a Reckoning on Hot Wallets
The largest crypto theft on record
What Binance says happened
Binance said its initial investigation traced the intrusion to a compromised DevOps engineer's laptop, which let an attacker reach an internal service container and submit unauthorized withdrawal transactions. The exchange later added that investigators had found additional points of breach, calling it a complex attack rather than a single one-click operation. Binance said it had found no evidence of a wallet private key leak. Co-CEO Richard Teng stressed that the attacker did not simply use one engineer's permissions.
How one transaction moved a fortune
On Ethereum, the attacker used a feature called EIP-7702 to hand control of a Binance hot wallet to its own code, TRM said. A single transaction then moved 167,464 ETH plus 63 other tokens, including 1.615 billion USDT. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said it looked like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet, raising questions about why stronger approval controls were not in place.
About $3 billion frozen, billions still missing
All losses covered, exchange says
Binance suspended all deposits and withdrawals after the attack and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company reserves. "User funds are safe," the company said. Co-founder and co-CEO Yi He said customer withdrawals should resume by Sunday, and Binance later said it remained on track to resume withdrawals within 45 hours while coordinating with law enforcement.
North Korea blamed with high confidence
TRM Labs attributed the attack to TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38, saying it made the judgment with high confidence based on on- and off-chain intelligence. Chainalysis and Elliptic also linked the theft to North Korean actors. The same network has been blamed for the Bybit heist. Zhao wrote on social media that the theft does look like a hack on Binance.
Why this shakes confidence in exchange wallets
A hot wallet is a wallet an exchange keeps connected to the internet to pay out customer withdrawals. Compromise its signing infrastructure and legitimate-looking transactions can drain billions before anyone reacts. "I think it's extremely dangerous," Tyler Moore, a cybersecurity professor at the University of Tulsa, said. "I think you should be very wary of leaving any significant amount of funds in an exchange." Analysts advise keeping no more on an exchange than needed for trading, with long-term holdings in a wallet where the user controls the private keys. Even users whose accounts were untouched lost access when withdrawals were suspended.
What comes next
Three things matter now: how much of the remaining $3 billion-plus can be traced or recovered, when SAFU payouts reach users, and whether withdrawals resume on schedule. With roughly half the loot frozen through issuer cooperation and half converted into assets that cannot be frozen, the case is also a stress test of the industry's freeze-and-trace playbook against an adversary that reporters link to a state-backed operation.
