In an unprecedented breach, hackers stole approximately $6.3 billion from Binance on Thursday, marking the largest cryptocurrency theft in history. The fallout has sent shockwaves through the crypto community, prompting urgent discussions about security protocols and industry resilience.
Following the theft, industry partners acted swiftly, freezing around $3 billion of the impacted assets. Binance has assured users that it will cover all losses using company funds, emphasizing its commitment to customer security.
According to findings from TRM Labs, the breach was executed using Ethereum’s EIP-7702 feature, which allowed attackers to take control of a hot wallet without the usual security checks that Binance has in place. This sophisticated attack has been linked to North Korea’s notorious TraderTraitor group, the same entity implicated in the $1.5 billion Bybit heist back in February 2025.
Understanding the Attack
Richard Teng, co-CEO of Binance, detailed how the attackers leveraged this Ethereum feature to manipulate the hot wallet. “The EIP-7702 delegation allowed the hackers to act on behalf of the wallet without going through our standard approval processes,” he explained. Furthermore, a built-in self-destruct mechanism erased tools and traces that could have aided the investigation, complicating recovery efforts.
Experts believe that the compromised signing systems facilitated the theft, as the attackers likely used several methods to circumvent security measures. Despite these breaches, Binance has reported no evidence of leaked private keys, providing a glimmer of hope for customer safety.
As investigators continue to unravel the complexities of the attack, they have discovered additional vulnerabilities beyond the initial compromised laptop, indicating a more extensive security challenge than previously thought. Chainalysis reported a series of rapid transactions that suggest automated laundering of the stolen funds.
Binance’s Response and Recovery Plan
In a bid to reassure users, Binance has set aside over $6.34 billion in company funds to cover the losses, which includes approximately $5 billion already held in the compromised tokens. The exchange is actively procuring the remaining tokens through various exchanges and over-the-counter deals.
Despite the turmoil, Binance has clarified that the attack primarily affected its hot wallet, and customer funds remain secure. A review of Binance’s reserves confirmed that the compromised wallets were previously listed as part of the assets backing customer balances.
The theft has had ripple effects on the broader market, with decentralized lender Aave temporarily halting new deposits and borrowing as a precautionary measure. However, Aave has since reopened its markets.
As Binance works diligently to restore confidence, withdrawals remain suspended while the company undertakes comprehensive system tests and security checks. The exchange plans to gradually reopen withdrawals starting Sunday, November 1, contingent on the completion of security assessments. A proof-of-reserves report is expected to be released by Monday, providing further clarity on the situation.
With the crypto landscape continually evolving, this incident serves as a stark reminder of the importance of robust security measures in protecting digital assets. As Binance navigates these challenges, the industry watches closely, anticipating both the immediate and long-term impacts of this significant breach.
