Binance has suffered the largest crypto theft on record. Attackers moved about $6.36 billion out of the exchange's hot wallets - the internet-connected wallets used to pay out customer withdr
Binance has suffered the largest crypto theft on record.
Attackers moved about $6.36 billion out of the exchange's hot wallets - the internet-connected wallets used to pay out customer withdrawals - across ten blockchains late Thursday, most of it in about 20 minutes, according to TRM Labs.
Bitcoin sold off as the news spread. Hourly CoinGecko figures show it traded near $80,769 at 4 p.m. ET Thursday, minutes before the first outflows, slid about 2.5% within the hour, fell to about $76,700 by 10 p.m. ET, recovered toward $78,500 overnight, then drifted back to about $76,400 by mid-afternoon Friday ($76,472 at the 3:28 p.m. ET capture) - a net drop of roughly 5% from the pre-theft price.
Binance co-founder Changpeng "CZ" Zhao argues the headline number is misleading.
The theft is the biggest ever in dollar terms, he wrote, but not in Bitcoin terms. The on-chain data shows what he means.
The first unauthorized transfers left Binance hot wallets at 4:05 p.m. ET Thursday, per TRM Labs. Chainalysis puts the start at about 4:20 p.m. ET.
On Ethereum, the attacker abused a new feature called EIP-7702, which lets a wallet temporarily run another program's code, using 50 authorizations signed in advance, TRM said.
On the nine other affected chains, funds left through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot-wallet signing infrastructure rather than a single stolen key.
Binance's preliminary finding is similar: a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals.
The exchange says it has found no evidence of a private-key leak.
Co-CEO Richard Teng later said investigators uncovered multiple breach points and called it "a complex attack.”
Withdrawals remain suspended while Binance rebuilds and tests its systems; deposits are unaffected.
Teng said the exchange aims to resume withdrawals by Sunday and will publish a Proof of Reserves report, a public attestation that customer balances are fully backed.
Valued at the time of transfer, the haul breaks down as $3.77 billion on Ethereum, $1.48 billion in bitcoin, $628 million on Tron, $300 million on the XRP Ledger and $96 million on Solana, according to an on-chain tally.
"$6.3 billion is the biggest in USD terms, but not in BTC terms," Zhao wrote in an X post.
"MtGox was 650,000 BTC!"
The stolen Bitcoin itself is precisely traceable. Binance's hot wallet sent 18,270 BTC, worth about $1.4 billion, to one address in 11 transactions confirmed in a single block; the attacker then split it across 19 wallets, where it sat unmoved as of early Friday, per mempool.space data and analytics firm Bitquery.
Measured against supply, the two thefts are different animals.
About 20.1 million Bitcoins are in circulation today (20,105,657, per Kraken on Oct. 30), so the Binance hacker's 18,270 BTC is about 0.09% of all coins. Mt. Gox's roughly 650,000 BTC, by contrast, was more than 5% of the Bitcoin in existence at the time - the U.S. Justice Department has tied about 647,000 BTC to that breach.
One clarification worth making: these were transfers of existing coins, not newly issued supply. The total number of bitcoins did not change. The stolen coins are simply parked in wallets the market can watch; as of early Friday, none had moved.
A comparison table Zhao shared estimates the Mt. Gox bitcoin would be worth more than $50 billion at today's prices.
At Mt. Gox, which collapsed in 2014, and at FTX, which failed in 2022, nearly all users and their assets were affected. In Binance's case, Zhao wrote, there is "only one victim" - the exchange itself.
Binance says it will cover all losses and has reserved more than $6.34 billion in company resources, including $5 billion already held in the exact tokens affected, with the remainder being bought on public markets and over the counter.
Its Secure Asset Fund for Users, an emergency reserve created in 2018, holds roughly $1 billion in Bitcoin.
Zhao did not play the hack down. "Obviously, still a major disaster for the industry, Binance (and me)," he wrote. "It hurts, but we survive. Most importantly, we protect our users."
The market's relatively measured reaction was captured early Friday by Bitcoin investor Anthony Pompliano:
"One of the largest crypto exchanges gets hacked for $6 billion and Bitcoin sold off less than 5%? Bullish."
At the time of his post, Bitcoin had pared its losses to under 5%; by mid-afternoon Friday it had slipped to fresh lows near $76,400 (3:00-3:28 p.m. ET captures).
The fastest counterattack came from stablecoin issuers - the companies behind dollar-pegged tokens, which can freeze their own tokens at specific blockchain addresses.
Binance says partners have frozen about $3 billion of the stolen funds.
But frozen does not mean returned.
"A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord, global head of policy at TRM Labs, told CNBC - typically a court order or seizure warrant before issuers reissue tokens to victims.
Stablecoins are the most recoverable asset class in crypto because the issuer controls the contract. Bitcoin and ether have no issuer; they can be traced but not frozen.
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, citing on-chain and off-chain intelligence.
The preparation - small withdrawals through Tornado Cash, a crypto mixing service, funding an operator wallet at least 36 hours before the theft, signatures obtained in advance and executed in one burst - matches the earlier Bybit and KelpDAO heists, TRM said.
Chainalysis reached the same conclusion, noting that funds stolen from Binance commingled on-chain with proceeds of last month's Bitget theft, also attributed to North Korea. No government has formally attributed the attack.
The FBI has said it is aware of the incident, and the U.S. Secret Service says it is working "around the clock" to identify, freeze, trace and recover the funds, per the BBC.
North Korea has stolen about $12.8 billion in crypto across 100 incidents since 2017, including $7.4 billion in 2026 alone, TRM estimates.
