The cryptocurrency sector is facing an unprecedented attack. Nearly 6.4 billion dollars were allegedly stolen during an intrusion targeting Binance, one of the leading global exchange platfor
The cryptocurrency sector is facing an unprecedented attack. Nearly 6.4 billion dollars were allegedly stolen during an intrusion targeting Binance, one of the leading global exchange platforms. The incident raises questions about infrastructure security, attacker responsibility, and fund protection. While several billion have already been frozen, a significant portion of the loot remains in the hands of the hackers. Here are the known facts and the main areas of uncertainty.
The attack against Binance began Thursday around 4:05 PM, Eastern US time, after the financial markets closed. The hackers then initiated several transfers from the platform’s hot wallets. They spread the funds across about ten blockchains, mainly during a roughly twenty-minute period. This operation quickly triggered an investigation across multiple networks and jurisdictions. Initial estimates revealed an exceptional scale.
Blockchain analysis firms Chainalysis and TRM Labs estimate the amount stolen at approximately 6.4 billion dollars. This figure far exceeds the previous record set during the Bybit hack in February 2025. That attack resulted in the disappearance of about 1.5 billion dollars in cryptocurrencies. The new incident thus represents more than four times that amount. It is now the largest theft ever reported in the sector’s history.
However, initial findings point the investigation toward an internal IT compromise rather than a blockchain flaw. Initial analysis mentions a compromised laptop belonging to a DevOps engineer. This access would have allowed the attackers to enter a service container and trigger unauthorized withdrawals.
Subsequently, the company identified other vulnerabilities. Its CEO, Richard Teng, notably mentioned a more complex process that was not limited to the permissions of a single engineer. The platform also claims that the hackers used a self-destruction mechanism to erase their tools and traces. However, it states that no indication of private key leaks from its wallets has been discovered.
On the Ethereum network, the attackers exploited EIP-7702, a feature introduced in 2025. This upgrade allows a regular wallet to temporarily execute code associated with a smart contract. It thus offers new technical possibilities to users. However, its use in this attack revealed risks linked to poor permission management. The problem identified mainly concerns how internal systems validated certain operations.
According to TRM Labs’ analysis, the hackers used fifty pre-signed authorizations. These allowed them to temporarily transform a platform hot wallet into a contract tasked with emptying its assets. The mechanism thus facilitated fund transfers without following usual controls. This method shows how a legitimate technical function can be exploited for malicious operations when security procedures fail. It is a core element of the technical investigation.
Richard Teng acknowledged that this delegation did not respect normal approval procedures. This statement sheds additional light on the attack’s functioning. Nevertheless, it does not imply a fundamental vulnerability in Ethereum. TRM Labs rather than locates the problem at the signature infrastructure used by the platform. In other words, available evidence points to internal permission and access management issues. Investigators still need to precisely establish how hackers obtained the necessary permissions.
Your 1st cryptos with BinanceThis link uses an affiliate program.The companies Chainalysis and TRM Labs both attribute this operation to the group TraderTraitor. This collective has ties with the North Korean state and is already suspected in the Bybit theft. This attribution is based on their analysis of fund movements and employed methods. It is an important element to understand the possible origin of the attack. However, the conclusions of specialized firms do not replace official investigation results.
After the theft, the attackers began moving part of the stolen assets. They notably converted about 84% of the stolen ethers into bitcoins. To carry out this operation, they used Thorchain, a network enabling transfers between different blockchains. This conversion complicates fund tracking and multiplies the networks involved in investigations. It also illustrates how quickly perpetrators can change the composition of their loot.
This operation brings in over one billion dollars in cryptocurrency gains attributed to North Korea for 2026. According to communicated estimates, the amount associated with this single attack far exceeds other sums involved. The financial scale of the case thus increases authorities’ interest in the group’s activities. Yet, several questions remain open about the precise identity of the operators and their organization. Investigators must especially determine individual responsibilities behind this operation.
In response to the attack, Richard Teng announced in a video posted on X that Binance would fully cover the losses with its own resources and its Asset Security Fund for users. This reserve is specifically intended for exceptional situations. The leader also states that customer funds were never touched. To finance this response, the company announced it had reserved more than 6.34 billion dollars. This sum is intended to cover estimated losses and maintain user protection.
About five billion dollars were already available as assets concerned by the hack. This reserve notably included BTC, ETH, BNB, USDC, and USDT. To complete the necessary amount, Binance buys the missing assets on traditional and over-the-counter markets. Meanwhile, it has suspended withdrawals to rebuild and test its systems. Deposits continue to operate normally. The platform also plans a complete security audit and the publication of a proof of reserves.
Stablecoin issuers quickly responded to early alerts. Tether froze more than 1.5 billion dollars in assets linked to the attack. Circle also blocked about 823 million dollars in USDC. These two companies can immobilize funds by blocking certain addresses on their respective networks. In total, about three billion dollars have thus been frozen or located. This intervention shows the special role private companies play in stablecoin management.
However, a large portion of the loot still escapes these measures. The hackers still control over 420,000 ETH and 18,270 BTC, as well as other tokens. The total represents a value exceeding three billion dollars according to available estimates. These assets cannot be frozen in the same way as centralized stablecoins. The attackers also continue transfers through Tron and other networks. Elliptic estimates they still hold about 3.3 billion dollars. Full fund recovery will largely depend on upcoming tracing operations.
The investigation now exceeds the platform’s scope alone. Binance cooperates with several international police services, notably the FBI and U.S. intelligence agencies. The FBI confirmed it is aware of the incident and is working with its partners. The Secret Service, also investigating digital currency financial crimes, has not publicly commented on the case. This cooperation recalls prior international operations against cryptocurrency money laundering.
In April, Operation Atlantic notably recovered tens of millions of dollars in stolen digital assets. This experience provides a precedent for current investigations. However, the amount involved this time is a much greater challenge. Investigators must track multiple assets, different blockchains, and cross-border transfers. Cooperation between authorities and specialized companies could therefore be crucial in the coming weeks.
Despite the scale of the Binance theft, the markets reacted with relative moderation. Bitcoin fell to around 76,400 dollars on Friday, a drop close to 4%. Simultaneously, over 1.3 billion dollars in leveraged positions were liquidated. This evolution remains different from that seen in March 2018. At that time, a failed attack on the platform caused Bitcoin to plunge nearly 11% within minutes.
Several analysts explain this limited reaction by the market’s current maturity. The total cryptocurrency market capitalization reaches about 2.6 trillion dollars. Furthermore, spot Bitcoin ETFs hold nearly 1.3 million BTC. These institutional investors do not necessarily react like retail operators to security incidents. Financial firms such as Cantor Fitzgerald, TD Cowen, and Compass Point have even encouraged some clients to buy crypto-linked stocks. They presented this attack as a platform-specific security problem rather than a direct threat to underlying technologies.
The Binance incident has also reignited the debate on offshore platform oversight. Michael Selig, chairman of the CFTC, used this case to advocate for greater U.S. regulation. During an interview with CNBC, he said this breach confirmed arguments advanced by his agency. This statement comes as the CFTC seeks to strengthen cryptocurrency market regulation. The case could thus feed discussions on security and control obligations imposed on international platforms.
At the same time, the case sparked a public exchange between Changpeng Zhao, Binance founder, and Elon Musk. The SpaceX and Tesla CEO seemed to criticize the platform after information about the hack surfaced. CZ responded, mentioning, notably, his company’s involvement in SpaceX. He recalled that this 500 million dollar investment in Twitter’s takeover now values over one billion. He also suggested that support from Musk would be appreciated. This exchange added a public dimension to an affair that sector stakeholders were already closely following.
Substantively, Changpeng Zhao has taken a defiant stance regarding the financial consequences of the attack. He acknowledged the theft as a dollar record, but not necessarily in bitcoins. He emphasized the company’s ability to absorb losses itself. According to him, this situation distinguishes the incident from previous major bankruptcies like Mt. Gox or FTX. He summarized this position by saying that the event hurts but the company can survive.
Several questions remain unanswered. Investigators still need to clarify all compromised access points and the exact course of operations. They also must determine how much funds can be recovered among assets still controlled by hackers. Finally, results of the security audit will assess the necessary changes in internal systems. The planned publication of proof of reserves will also be an important element for monitoring the situation.
Next steps will thus depend on investigation progress, wallet tracking, and full withdrawal service restoration. Authorities’ ability to identify perpetrators and recover remaining assets will be decisive. For the sector, this case could also accelerate discussions on operational security and platform oversight. The case thus reminds us that infrastructure protection remains a central issue, even when blockchains themselves present no flaws.
