Binance has put the damage from this week’s intrusion at about $6.3 billion, the largest cryptocurrency theft on record and roughly four times the $1.5 billion taken from Bybit in February 2025.
Across ten blockchains on October 29, TRM Labs followed every transfer and counted $6.36 billion flowing out of Binance wallets, almost all of it within about twenty minutes.
The exchange’s early account points at a laptop. A compromised DevOps engineer’s machine gave an attacker access to a service container and the ability to submit unauthorized withdrawals, though Binance found no evidence that a wallet private key leaked. That covers only part of the picture.
Delegation through EIP-7702 carried the Ethereum leg: a standard wallet signs a permission and hands its behavior to a smart contract. A hot wallet had already signed all 50, sent as one batch, arranged so one would align with the wallet’s transaction count at execution.
Nine more chains, with different key types and signing schemes, also produced valid signatures for the attacker within about half an hour, which TRM reads as the intruder gaining the ability to make Binance’s hot wallet signing system approve transactions.
Saturday-morning engineering, not a smash and grab: at least 36 hours of preparation preceded the theft. A handful of Tornado Cash withdrawals seeded the operator wallet, and the malicious code ran against other wallets first.
Binance froze roughly $2.5 billion during the night, a figure that climbed toward $3 billion with help from Tether and Circle, which blacklisted more than 800 million USDC. Deposits have resumed. Withdrawals stay paused while that service is rebuilt, and the Secure Asset Fund for Users stands behind losses.
Blockchain intelligence firms attribute the operation to North Korea’s TraderTraitor group, the cluster behind the Bybit raid.
