The world's largest cryptocurrency exchange has been hit by the biggest crypto heist in history. Hackers drained roughly $6.36 billion from Binance's hot wallets across ten blockchains on Thursday, October 29, according to blockchain analytics firm TRM Labs, which has linked the attack with high confidence to a North Korean hacking unit. Binance has confirmed a security incident, limited withdrawals on several networks, and says user funds are safe.
How the Attack Unfolded
Most of the theft happened in a window of about 20 minutes, beginning at 20:05 UTC (1:35 am IST on Friday). A second wave around 23:05 UTC hit Binance wallets on the Avalanche and Polygon networks.
On Ethereum, the attackers used a feature called EIP-7702, added in the network's 2025 Pectra upgrade, which allows an ordinary wallet to temporarily run smart-contract code. By getting a Binance hot wallet to delegate control to a "sweeper" contract only they controlled, the hackers moved 167,464 ETH and more than 60 tokens in a single transaction. On the other chains, funds left through normal-looking signed transfers, which TRM says points to a likely compromise of Binance's hot-wallet signing systems. Binance has not yet published an official root cause.
Co-founder Changpeng "CZ" Zhao, who no longer holds an executive role, said on X that the exchange "appears to have been hacked", while a company spokesperson said security teams were "reviewing all relevant information with urgency".
What Was Stolen
| Blockchain | Approximate Loss |
|---|---|
| Ethereum (ETH, USDT, USDC and others) | About $3.79 billion |
| Bitcoin (18,270 BTC) | About $1.47 billion |
| Tron (USDT, TRX) | About $628 million |
| XRP Ledger (233.46 million XRP) | About $296 million |
| Solana (970,500 SOL) | About $96 million |
| Arbitrum, Optimism, Base | About $39 million |
| Avalanche and Polygon | About $38 million |
| Total | About $6.36 billion |
That is roughly four times the $1.5 billion Bybit hack of February 2025, which until now held the record. Early estimates from traders on Thursday varied widely, but on-chain tracking has since settled around the $6.3 billion mark.
Who Is Behind It?
TRM Labs attributes the heist to TraderTraitor, a North Korean group that the FBI previously tied to the Bybit theft. Investigators found the operation was prepared well in advance: an operator wallet was funded through the Tornado Cash mixer from October 28, and the attack code was tested on other wallets first. The tactics, including pre-signed transactions, closely match earlier North Korea-linked attacks. Binance itself has not publicly confirmed who is responsible.
Billions Already Frozen
There is some good news. Stablecoin issuers moved fast. By early Friday, Tether had frozen about 1.77 billion USDT and Circle about 825 million USDC, while Ripple, World Liberty Financial and Arbitrum's Security Council froze further amounts. In all, about $2.7 billion has been locked so that the hackers cannot use it. However, more than 420,000 ETH and the stolen bitcoin – worth around $2.4 billion – sit beyond the reach of any issuer, and analysts expect the hackers to try laundering them through bridges and over-the-counter brokers.
What It Means for Indian Crypto Users
Binance is registered with India's Financial Intelligence Unit and has a large user base here, so many Indian investors will be anxious. Here is what you should do right now:
- Don't panic-sell. Binance says customer balances are safe and that it will cover losses, much as it has done with its user protection fund in the past.
- Expect delays. Withdrawals on some networks are limited while the exchange secures its systems.
- Beware of scams. Fraudsters often pose as "Binance support" after big incidents. Never share OTPs, seed phrases or 2FA codes.
- Use official channels only. Check updates only on the Binance app or its verified accounts.
- Review your security. Turn on passkeys or hardware-key 2FA and enable withdrawal address allow-lists.
What Happens Next
All eyes are now on Binance's official post-mortem, which should explain how the signing systems were breached. Regulators across the world are likely to ask tougher questions about how exchanges secure hot wallets, and the EIP-7702 technique may prompt fresh security guidance for every Ethereum-based platform. For the wider market, the size of the theft is a stark reminder that even the biggest names in crypto are not immune to state-backed hackers.
Comments (0)