The largest crypto hack in history: what we know about the $6.3 billion Binance breach

On the evening of October 29, blockchain analysts noticed that almost all the funds in the wallet that block explorers label Binance 14 had left it within minutes. Early estimates put the loss at $2.5–3.5 billion, by night the figure had grown to $5.5 billion, and on the morning of October 30 Binance gave its own estimate – about $6.3 billion. TRM Labs counted $6.36 billion at prices at the time of the theft, Chainalysis – between $5.9 and $6.4 billion.

Until now, the record belonged to the Bybit hack of February 2025, when attackers took about $1.46 billion. The Binance attack is roughly four times larger. It is not the exchange's first incident either, but the scale is not comparable: in 2019, 7,000 BTC (about $40 million at the time) was stolen from Binance, and in 2022 a BNB Chain bridge vulnerability was used to mint 2 million BNB worth $570 million.

How the attack worked: 50 signatures and one that mattered

The key episode took place on Ethereum. Since May 2025 and the Pectra upgrade, the network has supported EIP-7702. It lets a regular wallet hand control over to a smart contract: the owner signs an authorization, and from that moment calls to the wallet run the contract's code – with access to all of its balances. The authorization is tied to the nonce, the wallet's transaction sequence number.

Binance 14 is a working hot wallet that processes withdrawals nonstop, so its nonce changes every minute. The attacker could not guess the exact value and found a way around it: at 20:20:59 UTC, he sent one transaction with 50 signed authorizations – one for every nonce from 18,914,775 to 18,914,824. According to Blockaid, 49 of them were invalid and one matched. That is how Binance 14 became tied to the attacker's contract.

The contract itself had been deployed at 15:59 UTC and accepted commands from only one address – the operator. Its sweep() function moved all of the wallet's ETH and tokens to a specified address, leaving 1 ETH for gas. At 20:24:23 UTC, the operator called it: 167,464 ETH, 1.615 billion USDT and about 60 other tokens – roughly $2.5 billion – left Binance 14 for a fresh address with no history. Twenty-four seconds later, 28,005.6 ETH, 55.7 million USDT and 25.9 million RLUSD arrived at the same address from the Binance 16 wallet.

The preparation took more than a day. On the morning of October 28, the operator received gas money through three withdrawals from the Tornado Cash mixer. The next day, he ran the whole scheme twice on his own wallets – with $9 and $2.54 – and a few hours later attacked Binance.

The delegation does not expire on its own. Until Binance revoked the authorization, the wallet kept obeying the contract, and the attacker took advantage of that: at 20:41 UTC he used Binance 14 to pull another 780 million USDC from the Binance Hot Wallet 34 smart wallet, which Binance 14 controlled, and then another 43 million USDC. In total, Binance 14 was swept four times: the second, third and fourth waves took funds that kept arriving at the wallet after the first one. The third wave, at 21:44 UTC, took a fresh 200 million USDT, but it landed on an address that had already been frozen and got stuck there.

The attack hit ten blockchains at once

Ethereum was not the only target. According to TRM Labs' timeline, the first transfers started at 20:05 UTC: within four minutes, five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single address. At 20:10, wallets on Solana and Optimism were emptied, at 20:20 the Bitcoin hot wallet sent out 18,270 BTC, and within the next two minutes a Tron wallet transferred 612.7 million USDT and 46.4 million TRX. A second wave hit Avalanche and Polygon at 23:05.

Source: TRM Labs, estimate at prices at the time of the theft.

This detail matters. EIP-7702 exists only on Ethereum and compatible networks, while on Bitcoin, Tron and the XRP Ledger the Binance wallets sent funds with ordinary signed transactions. TRM concludes that the attacker gained access to the infrastructure that signs hot wallet transactions, rather than simply finding a weak spot in one contract.

What Binance says

For the first few hours, the exchange stayed silent. Around midnight UTC, Binance founder Changpeng Zhao (CZ) wrote that it "looks like a hack", thanked Tether and Circle for freezing funds quickly and promised that user funds would be fully covered. He added that he no longer runs the exchange and was speaking as a shareholder.

Binance then suspended withdrawals and, temporarily, deposits. Binance co-founder and co-CEO Yi He said that the exchange would cover all losses from the hack and publish a full breakdown after the investigation.

At 02:23 UTC on October 30, Binance published its initial findings. According to the exchange, the attack may have started with a compromised DevOps engineer's laptop: through it, the attacker gained access to a service container and sent unauthorized withdrawal transactions on behalf of the exchange. Binance found no signs of a private key leak and has revoked the authorization that tied Binance 14 to the attacker's contract. The exchange estimated the total damage at about $6.3 billion, of which about $3 billion had been frozen by then. Binance will cover the losses from its SAFU fund and its own capital and, once its systems are restored, will publish an updated Proof of Reserves.

Binance later clarified that deposits are working as usual, while withdrawals will stay paused until the team rebuilds its withdrawal system and the related addresses. It plans to resume them within 48 hours.

Only one assessment differs from the exchange's version. In its write-up, Blockaid refers to a "stolen key". Binance denies any key leak, and TRM speaks of a compromise of the signing infrastructure. Technically, both scenarios lead to the same result – transactions signed on behalf of the exchange – and a definitive answer will only come with the final post-mortem.

How much has been frozen

The attacker immediately ran into a problem: most of the loot was stablecoins, and their issuers can block addresses. At 21:01 UTC, 37 minutes after the main sweep, Tether froze 971.1 million USDT on the main collection address. Tether CEO Paolo Ardoino soon reported that the total had exceeded 1.567 billion USDT. Circle froze more than 800 million USDC, working together with law enforcement.

Ripple followed with a freeze of 40.5 million RLUSD, as did World Liberty Financial (27.8 million USD1) and First Digital (FDUSD). At 00:08 UTC, the Arbitrum Security Council – a body that can intervene in the network in emergencies – moved 74.56 million ARB and 8,425 ETH from the attacker's address to a restricted wallet. The funds can only leave it through a new council decision or an Arbitrum DAO vote.

By the morning of October 30, ZachXBT counted more than $2.83 billion in frozen funds, Binance – about $3 billion. That is almost half of what was stolen, but the rest cannot be frozen: nobody can block ETH, BTC, SOL or XRP. According to TRM, more than 420,000 ETH and 18,270 BTC – roughly $2.4 billion – remain out of the issuers' reach.

We covered how issuers freeze stablecoins and how such freezes end in our research on the $6.4 billion frozen by Tether and Circle.

Where the money is going

The attacker started laundering right away and paid heavily for speed. According to TRM, he sold about 325 million USDT to market makers through UniswapX and received roughly 122,300 ETH – at about $2,650 per ETH while the market price was $2,300–2,350. In other words, he overpaid by more than 10% just to get rid of the stablecoins before they were frozen.

Part of the USDT went into lending protocols. On Aave, the attacker deposited 60 million USDT and borrowed about 19,760 ETH against it, after which Aave froze its markets: 175 reserves on V3 and 117 on V4. On Tron, 300 million USDT went into the JustLend protocol, and about 200 million more USDT passed through intermediary wallets and was swapped on Uniswap. RLUSD worth 48 million was sold on decentralized exchanges before the freeze.

The bitcoins are being split through a peel chain: the 18,270 BTC is being broken into chunks of 1,000 and 100 BTC. TRM expects cross-chain bridges, swap services and OTC brokers to come next – just as after the Bitget hack in September.

Why the trail leads to North Korea

The link to Bitget turned out to be more than similar methods. On the morning of October 30, ZachXBT reported that funds from Binance and funds stolen from Bitget, after passing through THORChain, ended up at the same address. In his view, this suggests that the same actor is most likely behind both attacks. The $388 million Bitget hack had earlier been attributed to the North Korean group TraderTraitor, whose traces have also overlapped with other attacks, such as the one on Kelp DAO.

Analytics firms have reached the same conclusion. TRM Labs attributes the attack to TraderTraitor with "high confidence" based on on-chain and off-chain data. Chainalysis CEO Jonathan Levin wrote:

TraderTraitor is a unit of North Korea's Lazarus Group. The FBI has previously linked it to the 2025 Bybit hack and the theft of $308 million from Japan's DMM Bitcoin in 2024. In the DMM case, the attacker posed as a recruiter and sent an employee of the wallet provider a coding test containing malicious code. Binance's version about an engineer's compromised laptop fits this pattern well: TraderTraitor has long targeted not smart contracts but people with access to infrastructure.

We described how the Chinese networks that launder money for North Korea operate in our breakdown of ZachXBT's infiltration of one such network.

Rumors about Bybit and Bitget and the market reaction

Overnight, social media posts claimed that Bybit and Bitget had been hacked after Binance – supposedly for about $1 billion each. Bybit denied the rumors in a short statement: "Bybit is not affected". There is no confirmation of a Bitget hack at the time of publication.

The market fell. As of 01:19 UTC on October 30, bitcoin was down 4.9% at $76,937, ETH was down 5.7% at $2,211, and BNB was down 8% at $693. Tokens of the DeFi protocols used for laundering fell harder than the rest: AAVE by 11.3% and UNI by 10.7%. The Fear & Greed Index dropped to 30 for the first time since August. Market makers Wintermute and GSR disclosed their exposure to Binance: less than 20% and less than 5% of their own equity, respectively.

What comes next

The investigation continues. Binance promises a detailed technical post-mortem and a new reserves report, and several questions remain open: how exactly the attacker obtained signatures for 50 EIP-7702 authorizations, why a single entry point gave access to hot wallets on ten networks at once, and how much of the remaining $2.4 billion can be traced. We will update this article as new data emerges.

Addresses linked to the attack