Attackers drained an estimated $6.3 billion from Binance’s hot wallets late Thursday in what blockchain investigators say is the largest theft in crypto history, with Chainalysis, TRM Labs and Elliptic attributing the exploit to North Korea’s TraderTraitor group, according to CoinDesk.
Summary
- About $6.3 billion left Binance’s hot wallets in roughly 20 minutes on Thursday evening, across 10 blockchains.
- Binance’s initial investigation points to a compromised DevOps engineer’s laptop; the company says it has seen no evidence of a private key leak.
- Binance has set aside more than $6.34 billion of company resources to cover losses, and about $3 billion of the stolen funds has been frozen.
- Withdrawals are paused pending security checks; deposits remain open, and co-founder Yi He said withdrawals were expected to resume by Sunday.
The drain began at 20:24 UTC on Thursday and swept bitcoin, ether, USDT, USDC and smaller tokens out of the exchange’s hot wallets. In its official statement on X, Binance said its initial investigation pointed to a compromised DevOps engineer’s laptop that let an attacker reach a service container and submit unauthorized withdrawal requests — and promised to cover all losses from its SAFU fund and company funds.
A single transaction emptied a hot wallet
Early forensic reporting describes a Tornado Cash-funded address switching one of Binance’s hot wallets to run attacker-controlled code through an EIP-7702 delegation, allowing a single transaction to empty one of the exchange’s largest wallets. Binance later said it had found additional points of breach, while maintaining there is no evidence that wallet private keys were stolen.
The scale dwarfs every previous incident: at $6.3 billion, the theft is more than four times the $1.5 billion Bybit heist of February 2025, which the FBI also attributed to North Korea. “This was absolutely North Korea,” TRM investigator Nick Carlsen told the Wall Street Journal.
$6.34 billion set aside, $3 billion frozen
Binance says it already holds $5 billion in the exact token assets affected and is buying the remainder through public markets and OTC desks, on top of its roughly $1 billion SAFU emergency fund. “We will continue to use company resources to cover confirmed shortfall,” a spokesperson said. “Ultimately, all user funds will be verified publicly through our Proof of Reserves.”
About $3 billion of the stolen funds has been frozen by industry partners. Tether and Circle moved early to freeze roughly $1.7 billion in stolen stablecoins; Tether CEO Paolo Ardoino said Tether alone froze more than $1.5 billion of USDT. Chainalysis says the laundering that followed used techniques it had never observed before — thousands of automated transactions, coins cycled repeatedly between addresses — in what one analyst called “agentic money laundering.” Aave froze its lending markets across 16 networks after the exploiter borrowed about $44.6 million of ether against stolen USDT.
DefiLlama has now recorded 322 confirmed crypto incidents in 2026 with more than $8.7 billion in losses. OKX founder Star Xu responded by calling for shared exchange security standards, including extra checks and short delays on large withdrawals to unknown addresses, enforced at the signing layer.
