Binance suffered the largest cryptocurrency theft on record on Thursday, with hackers stealing approximately $6.3 billion. The attack surpassed previous breaches, including Bybit’s $1.5 billion loss in February 2025 and Bitget’s September breach. Onchain investigators linked the exploit to North Korea-backed hackers, similar to earlier incidents.
By Friday morning, Binance revealed that the breach involved multiple entry points, not just a single engineer’s compromised laptop. Co-CEO Richard Teng clarified that the attacker did not rely on one engineer’s permissions and that the investigation had not pinned responsibility on any individual. Binance committed over $6.34 billion in company funds to cover the losses, including $5 billion in the stolen tokens.
The Ethereum upgrade EIP-7702 came under scrutiny after attackers used it to drain a Binance wallet. Blockaid CEO Ido Ben-Natan suggested that compromised signing systems likely enabled the theft, though EIP-7702 may have helped bypass safeguards. Teng explained that the attacker used an EIP-7702 delegation to gain control over a hot wallet without standard approvals. A “self-destruct mechanism” further complicated the investigation by erasing tools and traces.
Chainalysis detected thousands of rapid transactions, possibly indicating automated laundering, with funds moving among addresses and sometimes returning to earlier wallets. The theft caused crypto prices to dip and led to a temporary freeze on new deposits and borrowing at decentralized lender Aave, which reopened its markets by Friday afternoon. Binance’s withdrawals remained suspended as the exchange worked to rebuild its withdrawal service and conduct a security review.
Teng stated that Binance aimed to resume withdrawals within 40 hours of his Friday update and planned to publish a full proof-of-reserves report by Monday.