Crypto has been hit by its largest theft on record.
On Thursday, attackers drained roughly $6.4 billion from Binance, the world’s largest cryptocurrency exchange. The breach is larger than any previous crypto theft and has already triggered a cross-border law-enforcement investigation, emergency freezes by stablecoin issuers, and a tense wait for millions of users.
What happened
The theft began at about 4:05 p.m. ET on Thursday, after U.S. markets had closed. Attackers moved funds out of Binance hot wallets across roughly 10 blockchains, with most of the transfers completed within about 20 minutes.
Blockchain analytics firms Chainalysis and TRM Labs estimated the total loss at around $6.4 billion. That is more than four times the previous record, the $1.5 billion Bybit heist in February 2025.
The attack hit Binance’s own infrastructure, not the blockchains themselves. Binance initially traced the breach to a compromised laptop used by a DevOps engineer, which may have allowed the attacker to reach a service container and submit unauthorized withdrawals.
The exchange later said its investigation found “additional points of breach.” CEO Richard Teng described “a more complex attack process” that “did not simply use one engineer’s permissions.” Binance also said it found no evidence that wallet private keys were leaked, and that the attacker used a self-destruct mechanism to erase tooling and traces during the operation.
The Ethereum angle
On Ethereum, the attacker used EIP-7702, a feature introduced in 2025 that allows ordinary wallets to temporarily run smart-contract code.
According to TRM Labs, the attacker used 50 pre-signed authorizations to turn a Binance hot wallet into a “sweeper” contract and drain its assets.
Teng said the delegation “did not pass through our normal approval controls.” TRM said the episode did not reveal a flaw in Ethereum itself. Instead, it pointed to a compromise in Binance’s signing infrastructure.
Who is being blamed
TRM Labs and Chainalysis both attributed the hack to TraderTraitor, a North Korean state-linked group that has also been blamed for the Bybit theft.
After the Bybit attack, the group converted roughly 84% of the stolen Ethereum into Bitcoin through the cross-chain network Thorchain. With this attribution, North Korea’s 2026 crypto haul moves well beyond $1 billion, and the Binance theft alone would exceed the rest.
Binance’s response
Teng said Binance will cover every dollar of the losses with company funds and its Secure Asset Fund for Users, an emergency reserve. He said customer assets were never touched.
The exchange has set aside more than $6.34 billion to absorb the loss. About $5 billion of that is already held in the exact tokens that were stolen, including BTC, ETH, BNB, USDC, and USDT. Binance is buying the remainder on the open market and over the counter.
Withdrawals were paused while the company rebuilds and retests its systems. Binance said it is conducting a full security review, aims to restore withdrawals by Sunday, and plans to publish a complete proof of reserves by Monday. Deposits continue to operate normally.
Frozen funds and what remains out of reach
Stablecoin issuers moved quickly after the first reports of a suspected attack, a faster response than in several earlier security incidents.
Stablecoins sit at the center of the crypto economy. These dollar-pegged tokens are designed to hold a steady value and make transfers easy across centralized and decentralized venues. Unlike Bitcoin or Ethereum, they are centrally issued and managed by private companies, which means issuers can freeze funds tied to specific addresses.
Tether, the issuer of USDT, froze more than $1.5 billion in assets. Circle, which issues USDC, froze around $823 million linked to the attack. Both companies used address blacklisting tools.
In total, roughly $3 billion has been frozen or located. A large amount remains beyond reach. The attacker still controls more than 420,000 ETH and 18,270 BTC, along with other tokens, worth more than $3 billion that no issuer can freeze. The funds have continued moving through Tron and other networks. Security firm Elliptic estimated the hacker still controls around $3.3 billion.
The investigation
Binance said it is cooperating with law enforcement agencies around the world, including the FBI and the U.S. Secret Service.
The FBI confirmed it was aware of the incident and was coordinating with partners. The Secret Service, which investigates financial and digital-currency crimes, declined to comment.
The case echoes earlier joint efforts such as April’s Operation Atlantic, which traced tens of millions of dollars in stolen crypto.
Market reaction
For a theft of this size, the market response was relatively restrained.
Bitcoin fell to about $76,400 on Friday, down roughly 4%. More than $1.3 billion in leveraged positions were liquidated.
That reaction was far milder than in March 2018, when a failed attack on Binance knocked nearly 11% off Bitcoin within minutes. Analysts pointed to a larger and more mature market, now worth around $2.6 trillion, with spot Bitcoin ETFs holding roughly 1.3 million BTC in hands that do not panic-sell easily.
Wall Street firms including Cantor Fitzgerald, TD Cowen, and Compass Point even urged clients to buy crypto-linked stocks into the weakness, framing the episode as a Binance security failure rather than a threat to the underlying technology.
Political fallout and public sparring
CFTC Chairman Michael Selig used the breach to argue that offshore exchanges need U.S. oversight. In an interview with CNBC, Selig said the incident “proves our exact point” behind the crypto-market regulations the agency proposed earlier this month.
The hack also led to a public exchange between Binance founder Changpeng Zhao, known as CZ, and Elon Musk. The SpaceX and Tesla founder appeared to mock Binance over the incident on X. CZ responded by referring to Musk’s SpaceX stake, writing: “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support.”
CZ struck a defiant tone overall. He said the theft is the largest ever in dollar terms, but not in Bitcoin terms, and unlike Mt. Gox or FTX, Binance is absorbing the loss itself.
“It hurts, but we survive,” he wrote.
