Attackers drained roughly $6.4 billion from Binance on Thursday in the largest cryptocurrency hack ever recorded, a theft more than four times the size of the previous record. Binance says it will cover the losses entirely with company funds and its emergency reserve, for which it has set aside more than $6.34 billion.

The breach—the biggest in crypto's history—has triggered a cross-border law-enforcement investigation, a scramble by stablecoin issuers to freeze stolen funds, and a tense wait among the exchange's millions of users. Here is what is known so far about how the hack unfolded and what is being done about it.

What Happened

The theft began at about 4:05 p.m. ET on Thursday, after U.S. markets had closed, when attackers started moving funds out of Binance hot wallets—the internet-connected wallets exchanges keep funded to process withdrawals quickly—across roughly 10 blockchains. Most of the transfers were completed within about 20 minutes.

Blockchain analytics firms Chainalysis and TRM Labs put the total at around $6.4 billion—more than four times the previous record, February 2025's $1.5 billion heist at Bybit.

Crucially, the attack targeted Binance's own infrastructure rather than the blockchains themselves. The exchange initially traced the breach to a compromised laptop belonging to a DevOps engineer, which may have allowed the attacker to reach a service container and submit unauthorized withdrawals.

Binance has since said its investigation uncovered “additional points of breach,” with CEO Richard Teng describing “a more complex attack process” that “did not simply use one engineer's permissions.” The company said it found no evidence that wallet private keys were leaked, and that the attacker used a self-destruct mechanism to wipe tooling and traces along the way.

The Ethereum Factor

On Ethereum, the attacker relied on EIP-7702, a feature introduced in 2025 that allows ordinary wallets to temporarily run smart-contract code. Using 50 pre-signed authorizations, the attacker turned a Binance hot wallet into a “sweeper” contract—code that automatically collects any assets sent to an address—and drained its assets, according to TRM Labs.

Teng said the delegation “did not pass through our normal approval controls.” The episode did not expose a flaw in Ethereum itself, TRM said, but instead pointed to a compromise of Binance's signing infrastructure.

Who Is Behind the Attack

Both TRM Labs and Chainalysis attributed the hack to TraderTraitor, a North Korean state-linked group also blamed for the Bybit heist. After that earlier attack, the group converted roughly 84% of the stolen Ethereum into Bitcoin via the cross-chain network Thorchain—a track record that gives investigators a known laundering pattern to monitor as the Binance funds keep moving.

The attribution pushes North Korea's 2026 crypto haul well past $1 billion—and the Binance figure alone would dwarf the rest.

Binance's Response

Teng said Binance will cover every dollar of the losses with company funds and its Secure Asset Fund for Users, an emergency reserve, stressing that customer assets were never touched.

The exchange has set aside more than $6.34 billion, about $5 billion of it already held in the exact tokens stolen—including BTC, ETH, BNB, USDC, and USDT—and is buying the remainder on the open market and over the counter.

Binance has paused withdrawals while it rebuilds and retests its systems, is conducting a full security review, and aims to restore withdrawals by Sunday. It also plans to publish a complete proof of reserves—a verifiable accounting intended to show on-chain holdings can cover customer balances—by Monday. Deposits are operating normally.

The Sunday withdrawal target and the Monday reserves pledge give users two near-term checkpoints for tracking how the recovery progresses.

The Freeze—and What's Still Loose

Stablecoin issuers moved quickly following initial reports of a suspected attack, unlike in previous security incidents. Stablecoins—dollar-pegged tokens designed to hold a steady value—are the backbone of the crypto economy, enabling quick transactions on both centralized and decentralized exchanges. Unlike Bitcoin or Ethereum, they are centralized: issued and managed by private companies, which means these funds can be frozen at any time, and for any reason.

Tether, the company behind the market's largest stablecoin, USDT, froze more than $1.5 billion in assets. Circle, which issues the second-largest stablecoin, USDC, froze around $823 million tied to the attack, both using their ability to blacklist specific addresses.

In all, roughly $3 billion has been frozen or located. But a large sum remains beyond reach: the attacker still controls more than 420,000 ETH and 18,270 BTC, plus other tokens, worth over $3 billion that no issuer can freeze, and has kept shuffling funds through Tron and other networks. Security firm Elliptic estimated the hacker still controls around $3.3 billion.

The Investigation

Binance is cooperating with law enforcement worldwide, including the FBI and the U.S. Secret Service. The FBI confirmed it was aware of the incident and coordinating with partners; the Secret Service, which investigates financial and digital-currency crimes, declined to comment.

The effort echoes earlier joint operations such as April's Operation Atlantic, which traced tens of millions in stolen crypto. Recovering the roughly $3.3 billion Elliptic says remains in the attacker's control would dwarf that operation's scale.

How Markets Reacted

For a theft of this scale, markets stayed remarkably composed. Bitcoin fell to about $76,400 on Friday, down roughly 4%, and more than $1.3 billion in leveraged positions were liquidated.

That is a far cry from March 2018, when a failed attack on Binance knocked nearly 11% off Bitcoin in minutes. Analysts credit a bigger, more mature market—now worth around $2.6 trillion—with spot Bitcoin ETFs holding roughly 1.3 million BTC in hands that do not panic-sell.

Wall Street firms including Cantor Fitzgerald, TD Cowen, and Compass Point even urged clients to buy crypto-linked stocks on the weakness, framing the hack as a Binance security failure rather than a threat to the underlying technology.

Regulatory and Public Fallout

CFTC Chairman Michael Selig seized on the breach to argue that offshore exchanges need U.S. oversight. In an interview with CNBC, Selig said the breach “proves our exact point” behind the crypto-market regulations the agency proposed earlier this month—a proposal that now has a concrete case to point to.

The episode also sparked a public spat between Binance founder Changpeng Zhao, better known as CZ, and Elon Musk. The SpaceX and Tesla founder appeared to troll Binance over the hack on X, and CZ fired back, citing Musk's own SpaceX stake. “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support,” CZ posted on X.

CZ struck a defiant note overall: the theft is the largest in dollar terms, he said, but not in Bitcoin terms—and unlike Mt. Gox or FTX, Binance is absorbing the loss itself. “It hurts, but we survive,” he wrote.

Source: Decrypt — Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History