On Thursday, attackers stole approximately $6.4 billion from Binance, the world’s largest cryptocurrency exchange, in what analysts describe as the largest crypto hack in history. The theft, which exceeded the previous record set by the Bybit heist in February 2025 by more than four times, began around 4:05 p.m. ET and involved moving funds out of Binance hot wallets across roughly 10 blockchains within about 20 minutes. Blockchain analytics firms Chainalysis and TRM Labs attributed the attack to TraderTraitor, a North Korean state-linked group previously blamed for the Bybit breach.
Binance CEO Richard Teng stated that the company will cover all losses using its own funds and its Secure Asset Fund for Users, an emergency reserve totaling over $6.34 billion. The exchange has paused withdrawals to rebuild and retest security systems, aiming to restore them by Sunday and publish a complete proof of reserves by Monday. While customer assets were reportedly untouched, the breach targeted Binance’s infrastructure rather than the underlying blockchains. Initial investigations pointed to a compromised DevOps engineer laptop, but further analysis revealed additional points of entry and a complex attack process that bypassed normal approval controls via EIP-7702 on Ethereum.
Stablecoin issuers Tether and Circle froze approximately $1.5 billion and $823 million respectively, bringing the total frozen or located assets to roughly $3 billion. However, Elliptic estimates that the attacker still controls over $3.3 billion in un-freezable assets, including 420,000 ETH and 18,270 BTC, which are being shuffled through networks like Tron. Law enforcement agencies, including the FBI and U.S. Secret Service, are coordinating a cross-border investigation. Market reaction was relatively composed compared to past incidents, with Bitcoin falling about 4% to $76,400, while some Wall Street firms urged clients to view the event as a specific security failure rather than a systemic threat.
The magnitude of this breach underscores the persistent vulnerability of centralized exchanges despite years of security hardening. By attributing the attack to TraderTraitor, the incident reinforces the role of state-sponsored actors in crypto crime, pushing North Korea’s estimated 2026 crypto haul well past $1 billion. The use of EIP-7702 highlights how new protocol features can be exploited if internal signing infrastructure is compromised, shifting the focus from blockchain flaws to operational security failures at the custodial level.
Regulatory implications are immediate, with CFTC Chairman Michael Selig citing the hack to advocate for U.S. oversight of offshore exchanges. This aligns with broader efforts to integrate major platforms into domestic regulatory frameworks. Meanwhile, the market’s resilience suggests growing institutional maturity, yet the ability of stablecoin issuers to freeze funds raises questions about decentralization principles. The remaining $3.3 billion in loose assets poses ongoing risks for laundering and further destabilization, requiring sustained international cooperation to track and recover.
