Binance was hit by a theft that onchain investigators estimate exceeded $6 billion, potentially making it the largest cryptocurrency heist on record. The attack appears to have involved compromised wallet-signing processes across multiple blockchains rather than the exposure of a single private key, creating a far more complex recovery and security challenge for the exchange.
Binance said its initial review identified a compromised DevOps engineer's laptop and unauthorized access to a service container. The company said it had found no evidence that private keys themselves had leaked, pointing instead to a failure in the operational environment used to manage wallet activity.
The exchange placed the value of affected assets at about $5 billion, below estimates from some blockchain investigators. Binance also said it was acquiring a further $1.3 billion through market and over-the-counter channels as part of its plan to cover user losses and restore withdrawals.
Richard Teng, chief executive officer of Binance, said the exchange was working to publish an initial proof-of-reserves report by Monday. He also said users were expected to regain withdrawal access before a Sunday deadline, within 40 hours of his statement.
Attackers reportedly exploited signing infrastructure
The incident has focused attention on the systems surrounding hot-wallet signing, where wallets connected to the internet rely on tightly controlled operational processes to approve transfers. Onchain evidence cited by TRM Labs indicates the attackers gained the ability to make unauthorized transactions through Binance's wallet infrastructure on multiple networks.
TRM Labs said the attacker prepared the operation at least 36 hours before the main theft. An operational wallet was funded through small withdrawals from Tornado Cash, the cryptocurrency mixing service, before malicious code was deployed and tested against three wallets.
That preparation reduced the need for improvised activity during the theft itself. Testing wallet interactions in advance would have allowed the attacker to identify working routes for transferring assets before initiating a larger series of transactions.
On Ethereum, TRM Labs said the attacker used EIP-7702, an Ethereum account-abstraction feature, to convert a Binance hot wallet into a sweeper wallet controlled by the attacker. A sweeper can automatically move assets received by a compromised address, allowing deposits to be drained without requiring each transaction to be manually initiated.
TRM Labs said the attacker created 50 pre-signed authorizations in advance. The apparent aim was to ensure that at least one authorization remained valid when the operation was executed. The firm also identified coordinated transfers across nine additional blockchains, suggesting that the breach extended beyond one Ethereum wallet or isolated transaction path.
North Korean attribution remains based on onchain patterns
Several blockchain tracing firms connected the activity to North Korean hacking groups, citing operational patterns seen in earlier attacks. TRM Labs linked the incident to the group associated with the $1.5 billion theft from Bybit, one of the largest previously recorded crypto exchange breaches.
The attribution relies on behavioral and technical indicators rather than a public claim of responsibility. TRM Labs cited the use of Tornado Cash for operational funding, advance staging, and pre-signed transaction authorizations as patterns consistent with prior North Korean-linked operations.
Elliptic offered a narrower assessment of a possible connection to another recent exchange incident. The firm said there was overlap between the Binance theft and last month's Bitget exploit, but only a small portion of the stolen Binance funds was involved. That overlap alone, Elliptic said, did not establish that the same attackers carried out both operations.
The distinction matters for tracing efforts. Shared wallets, bridges, mixers, and decentralized finance services can create transaction links between separate criminal operations, especially when attackers move rapidly through common liquidity routes.
Stolen funds moved through Ethereum and DeFi protocols
Chainalysis reported that the attacker executed thousands of transactions within a short period and repeatedly moved stolen assets between addresses. The rapid movement appears designed to complicate tracking and reduce the chance that centralized issuers or platforms could block assets before they were converted.
Chainalysis said the attacker swapped $325 million in stablecoins for $285 million in ETH in almost 20 minutes. The conversion appears to have reduced exposure to stablecoin freezes, though it came at a substantial cost: the attacker accepted roughly $40 million in value losses compared with prevailing market prices.
Elliptic said the attacker retained access after the initial breach by using compromised wallet-owner rights to pull funds from another Binance wallet and sweep fresh deposits. A second Ethereum hot wallet was reported to have transferred $174 million directly to the attacker.
The firm also reported that $59.9 million in stolen USDT was deposited into Aave as collateral, against which the attacker borrowed 19,762 ETH. Elliptic said the borrowing position remained open and was close to liquidation at the time of its update, exposing the attacker to the possibility that a further decline in collateral value could trigger automated asset sales.
Hundreds of millions of dollars in USDT were also exchanged for ETH through decentralized exchanges and market makers, Elliptic said. Some of those swaps reportedly occurred at discounts of as much as 26% to market prices, showing the trade-off attackers faced between quickly changing asset types and preserving the value of stolen funds.
Aave says protocol operations were unaffected
Aave said Friday that it had unfrozen all markets across its V3 and V4 protocols. The lending protocol said its smart contracts were unaffected and that user positions remained fully collateralized.
Aave's statement separates the security of its lending code from the source of collateral entering the protocol. DeFi applications can remain technically functional even when attackers attempt to use stolen assets within them, leaving protocol teams and asset issuers to decide how to respond to addresses tied to illicit activity.
The Binance case also demonstrates how a breach of internal operational permissions can spread faster than a conventional wallet compromise. If attackers can access valid signing workflows or account-owner privileges, they may be able to authorize transfers across several chains without needing to break cryptographic keys directly.
For Binance, restoring withdrawals and publishing reserves data will address the immediate pressure from users seeking confirmation that balances remain covered. The longer-term test will be whether its investigation can show how a compromised employee device and service container gained access to processes capable of moving billions of dollars across its hot-wallet network.
Worried about exchange hacks? Learn key protection steps in our guide on crypto safety standards every trader should know.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
