Inside the largest crypto hack on record: How attackers breached Binance for $6.3 billion

Binance was hit Thursday by the largest crypto hack to date, with blockchain investigators estimating that more than $6 billion in assets were stolen. Beyond the financial toll, the breach has raised questions about the security of centralized exchange infrastructure, particularly the hot wallets used to custody billions of dollars in customer assets.

Binance said its initial investigation pointed to a compromised DevOps engineer's laptop and unauthorized access to a service container. The exchange has not identified a private-key leak, while co-CEO Richard Teng has described the attack as more complex than a compromise of a single employee's permissions.

Blockchain investigators have attributed the attack to North Korean hackers. Their analysis suggests the attackers exploited Binance's internal systems and wallet-signing mechanisms to move funds across multiple blockchains.

How Binance was attacked

The attacker began staging at least 36 hours before the theft, funding an operational wallet with small Tornado Cash withdrawals, according to TRM Labs. It deployed and tested malicious code on three wallets before executing the attack.

On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper controlled by the attacker. It prepared 50 pre-signed authorizations to ensure one would remain valid when executed. TRM said coordinated transfers across nine other blockchains suggest a compromise of Binance's broader hot-wallet signing infrastructure.

Elliptic's analysis suggests the attacker retained access beyond the initial exploit, using one compromised wallet's owner rights to withdraw funds from another Binance wallet and repeatedly sweep new deposits. A second Ethereum hot wallet also sent $174 million in assets directly to the attacker, further pointing to access to Binance's broader transaction-signing infrastructure.

Simone Imbrescia, vice president of Immunefi, said the exploit highlights how an attack's sophistication does not necessarily lie in its onchain code, but in gaining access to the infrastructure capable of authorizing transactions.

"One of the striking things about this breach is how little code was actually needed on-chain. The sweeper contract was only around 130 lines," Imbrescia said. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating."

Chainalysis, Elliptic, and TRM attributed the attack to North Korean hacking groups, with TRM explicitly linking it to the same group connected to the $1.5 billion Bybit hack.

Chainalysis identified onchain links between funds stolen from Binance and proceeds from last month's Bitget exploit, which was also attributed to North Korean hackers. TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations. Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

Chainalysis identified thousands of transactions in a short period, with stolen funds repeatedly circulating between addresses. The attacker also attempted to avoid stablecoin freezes by converting $325 million in stablecoins into $285 million in ETH over nearly 20 minutes.

Elliptic said the attacker deposited $59.9 million in stolen USDT into Aave as collateral and borrowed 19,762 ETH. The loan remained open and was close to liquidation as of the firm's latest update. The attacker also swapped hundreds of millions of dollars in USDT for ETH through decentralized exchanges and market makers, accepting losses of as much as 26% against market prices to move funds into assets that issuers cannot freeze.

Aave said Friday that it had unfrozen all markets across its V3 and V4 protocols, adding that its smart contracts were unaffected and user positions remained fully collateralized.

Binance's financial position

Binance has approximately $5 billion in affected assets, with another $1.3 billion being acquired through market and OTC channels as part of its commitment to cover the losses.

Teng said the exchange was targeting Monday to publish its initial proof-of-reserves report and was working to restore withdrawals.

"We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours," Teng said in an X video on Friday.

TD Cowen analysts said the breach highlights the custody and cybersecurity risks associated with centralized exchanges but does not necessarily undermine the broader digital asset industry.

"The evidence available so far points to a compromise of infrastructure at a centralized intermediary, rather than a failure of Bitcoin or its underlying network," the analysts wrote. "Put differently, we do not stop using dollars when a bank is robbed, just as car theft does not invalidate the automobile."

The incident also highlights the need to secure the systems and processes that control access to private keys, Imbrescia said. Crypto security efforts often focus on protecting keys and auditing smart contracts, but the people, infrastructure and workflows capable of instructing those keys are part of the security perimeter, she added.

"If an attacker compromises that operational layer, they may not need to steal a key or discover an exotic smart-contract vulnerability at all," she said. "The broader lesson is that access controls, internal infrastructure and transaction-authorisation processes need to be secured with the same intensity as the keys themselves."