Binance says attackers stole about $6.3 billion in record crypto hack, withdrawals still paused

Binance said hackers stole about $6.3 billion on Thursday, making it the largest cryptocurrency theft on record. For PSPs and payment teams watching high-risk crypto flows, the important part is not just the size of the loss: the exchange has had to freeze withdrawals, rebuild its security controls, and explain how a hot wallet was drained without tripping its normal approval checks.

1. Onchain investigators attributed the exploit to North Korea-backed hackers, the same attribution pattern seen after Bybit’s $1.5 billion loss in February 2025 and September’s Bitget breach. By Friday morning, Binance said investigators had found additional breach points after initially suspecting that a compromised engineer laptop may have been the entry point.
2. Binance co-CEO Richard Teng said the attacker did not “simply use one engineer’s permissions,” and that the incident was not a single “one-click” action. He added that the investigation had not attributed responsibility to any individual.
3. Binance said it had set aside more than $6.34 billion in company funds to cover the losses, including $5 billion held in the same tokens stolen in the hack. That matters operationally because the exchange is trying to show it can absorb the hit without leaving users stuck in the middle.
4. The attack has also put Ethereum’s EIP-7702 upgrade under scrutiny after attackers used it to drain a Binance wallet. Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing Binance’s normal approval controls, while Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft.
5. Teng said a “self-destruct mechanism” destroyed tools and traces, which made the investigation harder. Chainalysis said it observed thousands of transactions in quick succession, pointing to automated laundering, with funds circulating among addresses and sometimes returning to wallets used earlier.

Binance said it is rebuilding its withdrawal service and conducting a company-wide security review. The exchange aims to resume withdrawals within 40 hours of Teng’s latest update and publish a full proof-of-reserves report by Monday. The theft also rattled crypto prices and led to a precautionary freeze on new deposits and borrowing at decentralized lender Aave, which reopened its markets on Friday afternoon.