Binance Hit by $6.3 Billion Crypto Hack After Engineer's Laptop Was Compromised

Binance, the world's largest cryptocurrency exchange, has suffered a security breach affecting an estimated $6.3 billion in digital assets, potentially making it the largest cryptocurrency hack in history. Most of the funds were moved across ten blockchains in approximately 20 minutes, according to blockchain intelligence firm TRM Labs.

Behind the multibillion-dollar breach may have been a single compromised laptop. Binance's preliminary investigation suggests hackers gained access through a DevOps engineer's computer, allowing them to reach an internal service and initiate unauthorised withdrawals. No evidence of leaked wallet private keys has been found.

A similar entry point played a central role in the February 2025 hack of Bybit. In that attack, hackers compromised a developer's workstation at Safe{Wallet}, a third-party wallet provider, before manipulating its transaction-signing interface to steal approximately $1.5 billion. The FBI later attributed the theft to TraderTraitor, a North Korean hacking operation.

Now, the same group is suspected of carrying out the Binance breach. TRM Labs has attributed the attack to TraderTraitor with high confidence, citing blockchain transactions and other intelligence. Binance has not independently confirmed who was responsible, and investigations are continuing.

On October 29, the first unauthorised transfers began at approximately 20:05 UTC. Within minutes, funds were leaving Binance wallets across several networks. By 20:20 UTC, the attacker had used an Ethereum feature known as EIP-7702 to delegate control of a Binance hot wallet, a wallet connected to the internet and used to process transactions, to malicious software.

Fifty pre-signed authorisations had been prepared in advance, according to TRM Labs. These enabled the attacker to establish control of the wallet despite its changing transaction count. Just over three minutes after the delegation, 167,464 ETH and dozens of other tokens were transferred to an attacker-controlled address. The malicious software remained active, allowing further withdrawals whenever new assets entered the wallet.

Ethereum was only part of the operation. Other Binance wallets sent funds through ordinary signed transactions on separate blockchains, suggesting the attackers had gained access to systems capable of authorising withdrawals across multiple networks.

By the time the attack was contained, approximately $6.36 billion had been transferred out of Binance wallets across ten blockchains. Blockchain evidence also indicates that preparations had begun at least 36 hours earlier, including transactions used to fund and test parts of the operation.

As the stolen cryptocurrency moved through the blockchain, a separate effort was underway to stop it. Stablecoin issuers Tether and Circle, alongside Ripple and other industry participants, froze assets associated with the attack. Binance says approximately $3 billion in affected funds has been frozen on-chain.

But the attackers were also moving quickly. Stablecoins such as USDT and USDC can be frozen by their issuers, preventing further transfers. Bitcoin and Ether cannot be blocked through the same mechanism.

TRM Labs found that the attackers exchanged large amounts of stolen stablecoins for other cryptocurrencies, including ETH and BTC, before freezing measures could reach them. In some cases, they also used decentralised lending protocols to obtain Ether against stolen stablecoin holdings.

Those transactions left billions of dollars outside the reach of the companies attempting to freeze the funds.

Binance Promises to Cover Customer Losses

Binance has temporarily suspended deposits and withdrawals while conducting security checks. The exchange has revoked the affected authorisation and is working with law enforcement agencies and blockchain intelligence firms to trace the stolen funds.

Customers will not be expected to bear the financial losses, according to Binance. The exchange plans to use its Secure Asset Fund for Users (SAFU), an emergency reserve established to protect customers during security incidents, alongside corporate funds to cover the damage. It has also promised a detailed technical report and updated Proof of Reserves once the investigation and security work are complete.

Cryptocurrency markets reacted to the breach, with Bitcoin and Ether falling as news of the attack spread. Binance's BNB token also came under selling pressure.

The scale of the theft exceeds the approximately $2.9 billion stolen across nearly 150 cryptocurrency attacks throughout 2025, according to TRM Labs. In a single incident, Binance has potentially lost more than twice the amount stolen across the entire industry last year.

And despite the billions already frozen, the attackers still control substantial cryptocurrency holdings. TRM Labs estimates that more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, remain in their possession.

Unlike the frozen stablecoins, these assets cannot be remotely blocked by a token issuer. Recovering them would depend on tracing their movement and intercepting them through exchanges or other cooperating services. Until then, billions of dollars remain in wallets beyond the direct reach of the companies trying to recover them.