Hackers stole roughly $6.3 billion from Binance on Thursday in what is now the largest cryptocurrency theft on record, dwarfing the $1.5 billion stolen from Bybit in February 2025. Industry partners have frozen approximately $3 billion in affected assets, while exchange customers await the reopening of withdrawals.

Blockchain analytics firm TRM Labs traced the first unauthorized transfers to around 8:05 pm UTC on Thursday, when Binance wallets were drained across multiple blockchains. The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals. Because they must stay online, hot wallets are generally considered the most exposed part of an exchange's infrastructure, and major exchange breaches have repeatedly centered on them.

TRM Labs attributed the attack to North Korea's TraderTraitor group, the same actor the US Federal Bureau of Investigation blamed for the Bybit theft. Binance has not publicly confirmed the identity of the attackers. If the attribution holds, the two largest cryptocurrency thefts on record would trace back to a single group.

The figures and timeline below are drawn from Cointelegraph's live coverage of the incident and the exchange's subsequent statements. The investigation is ongoing, and both the loss totals and the recovery schedule may change.

Binance reserves $6.34 billion to cover losses

Binance said it has reserved more than $6.34 billion in company funds to cover the losses, including $5 billion already held in the affected tokens. That allocation excludes the frozen assets, and the exchange said it is buying the remaining tokens through exchanges and over-the-counter deals. Together, the partner freezes and the company-funded reserve reflect the two main recovery levers in a theft of this scale: intercepting stolen funds as they move through the ecosystem, and replenishing customer balances from the exchange's own balance sheet.

A spokesperson told Cointelegraph the $5 billion was in Binance's custody but declined to disclose the wallet addresses, citing security concerns. Security firm CertiK said it needed more information to verify the holdings independently.

EIP-7702's role under scrutiny

Ethereum's EIP-7702 upgrade came under scrutiny after attackers used it to drain a Binance wallet. EIP-7702 is a feature that lets a wallet authorize software to act on its behalf. Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft.

According to Ben-Natan, the attackers could have stolen the funds without EIP-7702, but the feature may have helped them bypass safeguards and drain the assets in a single sweep.

Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing the exchange's normal approval controls. A "self-destruct mechanism" destroyed the tools and traces, complicating the investigation, he said.

Binance said investigators had also uncovered additional breaches beyond the initially suspected compromised laptop. However, the exchange reported no evidence that wallet private keys had leaked and said it expected to share further technical findings within about 48 hours.

"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng said. "Our investigation has not attributed responsibility to any individual."

Chainalysis observed thousands of transactions in quick succession that could indicate automated laundering, with funds circulating among addresses and at times returning to wallets used earlier.

Users await reopening of withdrawals

The theft rattled crypto prices and prompted decentralized lender Aave to impose a precautionary freeze on new deposits and borrowing. Aave announced on X that its markets reopened on Friday afternoon, while Binance's withdrawals remained suspended.

In a Friday update on X, Binance said it aimed to begin reopening withdrawals in stages on Sunday, Nov. 1, subject to completing security checks. Deposits and other unaffected services remained operational.

In an official announcement, the exchange also said it planned to take an initial proof-of-reserves snapshot within 12 hours of the announcement, with results ready by Monday. The report is intended to show the assets Binance holds and the backing of customer balances.

In a Saturday update, Binance said it had replenished 90% of the stolen assets and remained on track to open withdrawals by Sunday. Taken together, the staged reopening set to begin Sunday, the technical findings promised within about 48 hours, and the proof-of-reserves results due Monday form the timeline against which the exchange's recovery can be measured.