Cryptocurrency exchange Binance has confirmed the theft of approximately US$6.3 billion from its online wallets, promising to cover the losses while investigators examine how attackers gained access to systems trusted to authorise transfers.
What Happened?
The attack began on 29 October and affected Binance’s hot wallets, which are connected to the internet to support transactions. These are different from cold wallets, where the credentials needed to move funds are kept offline.
Blockchain intelligence company TRM Labs estimates that most of the stolen assets left Binance wallets within about 20 minutes. It describes the incident as the largest cryptocurrency theft on record, exceeding the US$1.5 billion stolen from rival exchange Bybit in February 2025.
Binance stopped customers from withdrawing funds while its teams investigated the attack and checked that its systems were secure. Although its initial announcement said deposits had also been suspended, the company later clarified that customers could still deposit funds and use other unaffected services.
How Did The Attackers Get In?
Binance initially believed the attackers might have gained access through the laptop of a DevOps engineer, whose job involves maintaining software and the systems it runs on. The company said this could have allowed them to reach an internal service and request unauthorised withdrawals. Further investigation has since uncovered other breaches, so the laptop may explain only part of what happened.
The company says it has found no evidence that the private keys used to authorise transfers were leaked. However, attackers would not necessarily need to steal those keys if they could take control of a system that uses them to approve transactions.
Investigators at blockchain analysis company Crystal Intelligence believe this could explain the transfers they examined. In other words, the attackers may have persuaded Binance’s own systems to approve the theft, although the investigation has yet to establish exactly how they did so.
How Were Wallet Permissions Abused?
Investigators are also examining how the attackers used an Ethereum feature called EIP-7702, which lets software carry out actions through a wallet once permission has been granted. It is designed to make transactions more convenient, for example by combining several steps or allowing another account to pay the fees.
In this case, investigators say the attackers used that permission to make a Binance wallet run malicious code that moved funds into their control. The question is how they obtained permission to do this, rather than whether they managed to rewrite Ethereum’s transaction records.
However, funds were also stolen through other blockchain networks, so this explains only part of the attack. Binance’s promised technical report should provide a clearer account of how the attackers gained access and got the transfers approved.
Who Is The Main Suspect?
TRM Labs, a company that traces cryptocurrency transactions and investigates financial crime, says it has high confidence that the North Korean hacking group TraderTraitor carried out the attack. Also, it seems blockchain analysis firm Elliptic has reached a similar assessment after tracing some of the stolen funds to an address also linked to another suspected North Korean theft.
Both companies’ findings point towards North Korean involvement, although responsibility has yet to be confirmed by the ongoing investigation. There is also no confirmed evidence that the attackers used AI to carry out the theft.
Has The Money Been Recovered?
Binance says it has worked with partners to freeze approximately US$3 billion of the stolen assets, preventing the attackers from moving those funds any further. However, freezing the assets is only a step towards recovery and does not mean the money has been returned.
While efforts to recover the stolen funds continue, Binance says it has set aside more than US$6.34 billion of its own money to cover the losses. Of that, US$5 billion is already held in the same cryptocurrencies that were taken, with the remaining assets being purchased. This is what the company means when it says around 80 per cent is covered. It does not mean that it has recovered 80 per cent of the stolen money.
Binance says it will pay for the losses through its Secure Asset Fund for Users and company funds, stating: “Binance will absorb the financial impact of these stolen funds, not our users.”
What Happens Next?
In its 30 October update, Binance said it aimed to begin reopening withdrawals in stages within approximately 34 hours, once security checks were complete. It also promised to publish updated information about the assets backing customer balances by 2 November, followed by a technical report explaining how the attack happened.
For customers, getting access to their money again is only part of the reassurance they need. Binance must also demonstrate that it holds enough assets to cover their balances and has fixed the weaknesses that allowed the theft. Replacing the stolen funds would cover the financial loss but would not on its own show that the platform is secure.
What Does This Mean For Your Business?
For businesses, this case highlights the need to consider what an attacker could do after gaining access to a staff account or device. Strong passwords and secure laptops are important, but limiting what each account can access can help stop an intruder reaching more sensitive systems. The NCSC recommends giving administrators only the permissions they need for their work.
That is especially important where systems can move money. Someone who maintains software shouldn’t automatically have permission to release payments, and larger or unusual transactions should require separate approval. Monitoring those transactions can also help staff spot suspicious activity and intervene before losses grow.
Businesses should also consider how they would keep operating if a provider holding their funds or handling payments suddenly stopped withdrawals. Binance has promised to cover the stolen assets, but customers still need access to their money and evidence that the weaknesses have been fixed. The incident shows why financial protection and reliable access both matter when choosing a provider.
