Binance Hit by $6.3 Billion Hack, Largest in Crypto History
Cryptocurrency exchange Binance suffered a historic $6.3 billion security breach after a compromised DevOps engineer laptop allowed an attacker to submit unauthorized withdrawal transactions. Industry partners successfully froze roughly $3 billion.
The largest cryptocurrency exchange has suffered the biggest crypto hack in history. Binance has quantified the security breach that targeted the platform on Thursday, October 29, confirming in an update issued today that nearly $6.3 billion was impacted. Because this is an ongoing situation, these figures may shift as Binance and its partners continue tracking the stolen assets.
Collaborative efforts across the industry successfully froze roughly $3 billion onchain, leaving approximately $3.3 billion out of reach as of this writing. According to DeFillama, the unrecovered amount alone surpasses the total funds stolen across the entire crypto sector over the course of last year, and matches the combined losses of 2023 and 2024.
A Compromised Laptop Gave the Attacker a Way In
Initial findings from Binance indicate the breach originated from a compromised DevOps engineer’s laptop. The exchange explained that the perpetrator used the device to access an internal service container, from which unauthorized withdrawal transactions were submitted. Binance currently reports no evidence that wallet private keys were compromised and intends to publish a comprehensive technical post-mortem after verifying all details.
Onchain data from Arkham confirms the attack began around 4:30 P.M. ET, with the culprit draining substantial amounts of Bitcoin, Ethereum, Tron, and Solana, among other digital assets. Tether CEO Paolo Ardoino announced via X that $1.567 billion in USDT had been frozen, while Circle CEO Jeremy Allaire verified the freezing of over $800 million in USDC. Additional stolen funds were frozen by Ripple, World Liberty, BitGo, Paxos, and the Arbitrum Security Council, which locked down about $30.5 million. Furthermore, Aave—the largest decentralized finance lending protocol—froze its lending markets defensively after the attacker borrowed Ethereum backed by stolen USDT.
Amid ongoing security verifications, Binance has temporarily halted deposits and withdrawals. The exchange has also revoked authorization for the compromised address and is collaborating with law enforcement and blockchain intelligence agencies to recover the assets. Binance has assured users that its SAFU emergency fund and corporate reserves will fully cover all user losses, pledging an updated Proof of Reserves following the remediation process.
Blockaid Traces the Drain Back to One Hot Wallet
Blockchain security firm Blockaid has released one of the most comprehensive onchain analyses of the attack to date, focusing on Binance 14, one of the exchange’s most active Ethereum hot wallets.
Blockaid reports that the attacker funded an operator address via Tornado Cash starting October 28, practicing the operation on personal wallets using test amounts between $2 and $6. At 20:20 UTC on October 29, the attacker broadcast a single transaction containing 50 EIP-7702 authorizations signed using the Binance 14 key. Because the wallet was actively processing withdrawals, the exact active nonce was unknown, prompting the attacker to sign a wide range of nonces; one successfully matched, transferring control of the wallet to an unverified sweeper contract controlled solely by the attacker.
Roughly three minutes later, the sweeper drained Binance 14 of 167,464 ETH, 1.615 billion USDT, and approximately 60 other tokens, totaling an estimated $2.5 billion at the time, leaving just 1 ETH behind. Over the subsequent 12 minutes, 10 additional Binance hot wallets across Ethereum, Arbitrum, Avalanche, and Optimism transferred funds to the same collection address. Because the delegation remained active, the attacker returned at 21:44 UTC to siphon another 200 million USDT in new deposits without requiring a fresh signature.
Ido Ben-Natan, CEO of Blockaid, stated that the evidence points toward compromised signing infrastructure rather than a leaked key, aligning with Binance’s report of a breached laptop and service container. Ben-Natan also noted that this incident vastly eclipses the $1.5 billion Bybit hack from February 2025.
While onchain investigator ZachXBT has raised suspicions regarding North Korea’s Lazarus Group, neither Binance nor any official authority has confirmed this attribution. Binance continues to advise users to rely exclusively on official channels for updates.
The smartest crypto minds already read our newsletter. Want in? Join them.
Comments 0 responses