Recap: How Binance’s Record $6.3B Hack Unfolded
An analysis of the massive security breach and Binance's subsequent reimbursement strategy.
1Record Breaking Crypto Theft
On Thursday, hackers executed the largest cryptocurrency theft in history, draining approximately $6.3 billion from Binance. Industry partners managed to freeze roughly $3 billion of the stolen assets shortly after the breach. While customers currently await the resumption of withdrawal services, the event has caused significant market volatility across various digital assets.
2Tracing the Initial Breach
TRM Labs identified the first unauthorized transfers occurring at 8:05 pm UTC on Thursday. The attackers systematically drained Binance hot wallets across multiple blockchains simultaneously. These wallets, which remain connected to the internet for processing withdrawals, were the primary target, allowing the perpetrators to bypass standard security protocols during the initial phase.
3Attribution and Security Claims
TRM Labs attributed the attack to the North Korean group TraderTraitor, previously linked to the $1.5 billion Bybit theft in February 2025. However, Binance co-CEO Richard Teng has not publicly confirmed this identity. Teng emphasized that the breach was not a simple one-click action or a single engineer's permission failure during the incident.
4EIP-7702 Vulnerability Analysis
The Ethereum EIP-7702 upgrade faced scrutiny after attackers utilized it to drain a Binance wallet. Blockaid CEO Ido Ben-Natan noted that compromised signing systems likely facilitated the theft. While the funds might have been stolen regardless, the delegation feature enabled attackers to bypass internal approval controls and drain assets in one sweep.
5Complex Investigation Challenges
Binance reported that the attackers employed a self-destruct mechanism to destroy tools and traces, significantly complicating the ongoing forensic investigation. Chainalysis observed thousands of rapid transactions, suggesting automated laundering techniques. Funds were circulated among various addresses, with some assets returning to previously used wallets, creating a complex trail for security researchers.
6Reimbursement and Asset Management
Binance has reserved over $6.34 billion in company funds to cover losses, including $5 billion already held in affected tokens. The exchange is actively purchasing remaining tokens through over-the-counter deals. However, the firm declined to disclose specific wallet addresses for security reasons, leaving independent verification of these holdings by CertiK currently pending.
7Broader Market Impact
The massive theft rattled global crypto prices and forced decentralized lender Aave to implement a precautionary freeze on new deposits and borrowing. Aave successfully reopened its markets by Friday afternoon. Meanwhile, Binance continues to keep its withdrawal services suspended while conducting a comprehensive company-wide security review to prevent any future recurrence of attacks.
8Path to Service Restoration
Binance is currently rebuilding its withdrawal infrastructure following the breach. Co-CEO Richard Teng announced plans to resume withdrawal services within 40 hours of his Friday update. Furthermore, the exchange committed to publishing a full proof-of-reserves report by Monday to restore user confidence and provide transparency regarding the actual status of recovered assets.
Original article: Cointelegraph.com News — Recap: How Binance’s Record $6.3B Hack Unfolded