What We Know About the Binance Hack, the Largest Crypto Theft on Record

Analysts fill in some mechanics. On Ethereum the attacker used EIP-7702, a feature from the May 2025 Pectra upgrade that lets an ordinary wallet temporarily run contract code. TRM Labs and Chainalysis say 50 authorisations signed by Binance 14 turned the wallet into a sweeper the attacker controlled, as Decrypt reports. TRM's larger point is that on the other nine chains the funds left through ordinary signed transfers, which it reads as a compromise of Binance's hot-wallet signing infrastructure rather than a flaw in Ethereum. Teng said on Friday afternoon that the delegation did not pass through Binance's normal approval controls and that the attacker used a self-destruct mechanism to erase traces.

Where the $6.3 billion figure comes from

The number is Binance's own estimate, published at 02:25 UTC, and it sits inside a cluster of independent tallies that value each asset at the moment it moved: TRM Labs about $6.36 billion across ten chains, Chainalysis at least $5.912 billion as of 00:30 UTC and later about $6.4 billion, Elliptic $6.43 billion across 11 chains, including $3.80 billion on Ethereum and $1.48 billion in bitcoin.

What is frozen is clearer: Tether more than $1.567 billion, Circle more than $800 million, Ripple about $200 million of RLUSD, World Liberty Financial about $27 million, and the Arbitrum Security Council about $30 million of ETH and ARB. Binance's round figure is $3 billion; Elliptic has verified $2.84 billion, 44 percent of the theft, almost all stablecoins. Roughly $3.2 billion to $3.3 billion in ether, bitcoin and other assets no issuer can freeze remains with the attacker.

Who pays, and when withdrawals come back

The SAFU emergency fund, created in 2018 and holding about $1 billion in bitcoin, was never going to cover this alone. On Friday Binance said it had reserved more than $6.34 billion of company funds, excluding the frozen assets, with about $5 billion already held in the exact tokens stolen and the rest being bought on the market and over the counter. CertiK and Nansen told Cointelegraph they could not yet verify the $5 billion on-chain. Teng says a full proof of reserves will follow by Monday 2 November and that customer assets were not touched.

Who is blaming North Korea

No government has named a culprit, and Binance says its investigation has not attributed responsibility to anyone. The attribution so far comes from private analysts. TRM Labs says, with what it calls high confidence, that the attack was the work of TraderTraitor, a North Korean unit it links to the Lazarus Group, citing staging and signature patterns that match the Bybit theft and April's KelpDAO exploit. Chainalysis chief executive Jonathan Levin said his firm reached the same conclusion because the stolen funds were commingling in real time with proceeds of September's Bitget hack. Elliptic calls DPRK involvement likely but notes the attacker was unusually slow to convert stablecoins, which is what allowed the freezes. ZachXBT called Lazarus the likely attacker, and Blockaid's Ido Ben-Natan said the tactics matched North Korean operations, CoinDesk reported. North Korea has denied previous hacking allegations, and the FBI, which named TraderTraitor for Bybit within five days, has said nothing about this case so far.

How it compares with Bybit and the old records

Bybit lost about $1.46 billion in February 2025 after a developer's machine at Safe{Wallet} was compromised, the previous record; before that came Ronin at about $625 million in 2022 and Poly Network at about $610 million in 2021. TRM counts about $2.9 billion stolen in all of 2025; Binance lost more than twice that in 20 minutes. Elliptic notes both exchanges fell to compromised infrastructure and people rather than broken cryptography, and that the Bybit funds took months to launder.

Next comes a weekend of waiting: withdrawals back on, the promised reserves report, and an explanation of how a laptop and whatever else was breached ended up signing away $6 billion. The attacker holds more than $3 billion that nobody can freeze, and the people paid to watch those wallets expect them to move.