# The Biggest Crypto Heist in History: What Happened at Binance
## A Record-Breaking Theft
The world of cryptocurrency experienced its largest security breach ever on a Thursday afternoon when attackers managed to steal approximately $6.4 billion from Binance, the planet’s biggest digital currency exchange. This staggering figure is more than four times greater than the previous record held by the February 2025 Bybit attack, which saw $1.5 billion taken.
The theft unfolded rapidly, beginning around 4:05 p.m. ET after U.S. stock markets had already closed for the day. Hackers moved funds out of Binance’s hot wallets — the online accounts used for daily transactions — spread across roughly ten different blockchains. Most of the draining happened within a terrifying 20-minute window.
## How Did the Attack Work?
Investigators believe the breach started with a compromised laptop belonging to one of Binance’s DevOps engineers. This may have given the attackers access to a service container, which they then used to submit unauthorized withdrawal requests.
However, Binance’s CEO Richard Teng later revealed that the investigation uncovered additional points of breach beyond the single compromised device. He described a more complex attack process that didn’t rely on just one engineer’s permissions. Remarkably, Binance stated there was no evidence that wallet private keys were leaked. The attackers also used a self-destruct mechanism to wipe their tools and erase traces as they went.
On the Ethereum blockchain specifically, the attackers exploited EIP-7702, a feature introduced in 2025 that allows regular wallets to temporarily run smart-contract code. Using 50 pre-signed authorizations, they converted a Binance hot wallet into a “sweeper” contract and drained its contents. Teng confirmed that this delegation bypassed the exchange’s normal approval controls.
## Who Was Responsible?
Both Chainalysis and TRM Labs, two leading blockchain intelligence firms, attributed the attack to TraderTraitor — a hacking group linked to North Korea. This same group was also blamed for the Bybit heist earlier this year.
North Korea’s total cryptocurrency haul for 2026 now exceeds $1 billion thanks to this attack, and the Binance theft alone makes that figure dwarf all previous years combined.
## Binance’s Response
Binance has taken swift action to make its users whole. CEO Teng confirmed the company will cover every single dollar of the losses using its own funds and the Secure Asset Fund for Users, an emergency reserve fund specifically created for situations like this.
The exchange has set aside more than $6.34 billion for recovery. About $5 billion of that is already held in the exact tokens that were stolen — including Bitcoin, Ethereum, BNB, USDC, and USDT — and the remainder is being purchased on the open market and through over-the-counter deals.
To secure its systems, Binance paused all withdrawals while it rebuilds and retests its infrastructure. A full security review is underway, and the exchange aims to restore withdrawals by Sunday. It also plans to publish a complete proof of reserves by Monday. Deposits have continued operating normally throughout the process.
## Freezes and What’s Still Missing
Stablecoin issuers responded quickly after reports of the attack surfaced. Tether, the company behind USDT (the largest stablecoin), froze more than $1.5 billion in assets. Circle, which issues USDC (the second largest), froze approximately $823 million tied to the attack. Both companies used their ability to blacklist specific wallet addresses.
In total, roughly $3 billion in stolen funds has been frozen or located. However, a significant amount remains beyond anyone’s reach. The attacker still controls more than 420,000 ETH and 18,270 BTC, along with other tokens, worth over $3 billion that no stablecoin issuer can freeze. The hacker has continued moving funds through networks like Tron and others. Security firm Elliptic estimates the attacker still controls around $3.3 billion.
## Law Enforcement Gets Involved
Binance is cooperating with law enforcement agencies worldwide, including the FBI and the U.S. Secret Service. The FBI confirmed awareness of the incident and is coordinating with partners. This echoes earlier joint operations like April’s Operation Atlantic, which successfully traced tens of millions in stolen cryptocurrency.
## Market Reaction
Despite the enormous scale of the theft, cryptocurrency markets remained surprisingly stable. Bitcoin dropped to about $76,400 on Friday — a decline of roughly 4% — and over $1.3 billion in leveraged positions were liquidated.
This reaction is dramatically different from what happened in March 2018, when a failed attack on Binance caused Bitcoin to fall nearly 11% in minutes. Analysts attribute the calmer response to a bigger, more mature market now worth around $2.6 trillion, with spot Bitcoin ETFs holding roughly 1.3 million BTC in accounts that don’t panic-sell.
Interestingly, several Wall Street firms including Cantor Fitzgerald, TD Cowen, and Compass Point encouraged clients to buy crypto-linked stocks during the dip, framing the hack as a Binance-specific security failure rather than a flaw in the underlying blockchain technology.
## Wider Implications
The breach sparked debate about crypto regulation. CFTC Chairman Michael Selig used the incident to argue that offshore exchanges need U.S. oversight, saying the breach “proves our exact point” behind crypto-market regulations his agency proposed earlier that month.
The episode also led to a public exchange between Binance founder Changpeng Zhao (known as CZ) and Elon Musk on social media. Musk appeared to comment about the hack, and CZ responded by noting his $500 million investment in Musk’s Twitter takeover. CZ struck a defiant tone overall, stating that while the theft is the largest in dollar terms, it is not the largest in Bitcoin terms, and unlike the Mt. Gox or FTX collapses, Binance is absorbing the loss itself.
—
## Frequently Asked Questions
**What is a hot wallet?**
A hot wallet is a cryptocurrency wallet that remains connected to the internet, used for everyday transactions. Because of its online nature, it is more vulnerable to hacking than a cold wallet, which is kept offline.
**What are stablecoins?**
Stablecoins are digital tokens designed to maintain a steady value, usually pegged to a traditional currency like the U.S. dollar. They are widely used in the crypto economy for quick and easy transactions on both centralized and decentralized exchanges. Unlike Bitcoin or Ethereum, stablecoins are centralized and issued by private companies, which gives those companies the power to freeze assets tied to specific addresses.
**What is EIP-7702?**
EIP-7702 is a blockchain feature introduced in 2025 that allows ordinary wallets to temporarily run smart-contract code. While this innovation brought new functionality to Ethereum, it was exploited by the attackers in this hack to turn a Binance wallet into a tool that could drain its own assets.
**Can frozen funds be recovered?**
Funds frozen by stablecoin issuers like Tether and Circle remain locked at those companies and can potentially be returned to their rightful owners if law enforcement identifies them. However, funds on blockchains where no freezing capability exists are much harder to recover.
**What is TraderTraitor?**
TraderTraitor is a hacking group widely believed to be backed by the North Korean government. It has been linked to multiple major cryptocurrency thefts and is considered one of the most prolific cybercrime organizations in the digital currency space.
**How does Binance plan to cover the losses?**
Binance has allocated over $6.34 billion from its own resources and the Secure Asset Fund for Users to cover every dollar lost. The exchange already holds approximately $5 billion in the specific tokens stolen and is acquiring the remainder through open market and over-the-counter purchases.
—
## Conclusion
The Binance hack of 2026 stands as a watershed moment in cryptocurrency history. At $6.4 billion, it is an attack of unprecedented scale that exposed vulnerabilities not in the underlying blockchain technology but in the security infrastructure of one of the industry’s largest companies. While the swift response from stablecoin issuers and the measured reaction from markets showed some maturity in the ecosystem, the incident also reignited critical conversations about regulation, security standards, and the concentration of risk in centralized exchanges. As law enforcement agencies worldwide investigate and Binance works to restore full operations, the industry watches closely — reminded that as the crypto world grows, so do the stakes of securing it.
Thank you for reading
