Binance says attackers moved $6.36 billion across ten blockchains

Binance says attackers moved approximately $6.36 billion from its wallets across ten blockchains, turning an initial “potential security issue” into what blockchain firms and experts describe as the largest crypto theft on record. The Associated Press reports that Binance has reserved more than $6.34 billion to cover losses, while blockchain partners have frozen about $3 billion. The exchange has suspended withdrawals as it investigates and works to recover assets.

The scale marks a sharp change from Binance’s first public account, which said the incident was under investigation and estimated the impact at around $6.3 billion. Its initial explanation pointed to a potentially compromised DevOps engineer’s laptop, but the company later reported finding additional “points of breach.” The sums remain estimates, and Binance has said its investigation is ongoing.

How did attackers get access to the wallets?

Binance co-CEO Richard Teng said the breach involved more than the initially suspected laptop. According to AP, blockchain intelligence firm TRM said an attacker moved the funds across ten blockchains, most of them in about 20 minutes, and attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit. Binance has not confirmed the attackers’ identity; it says it is working with law enforcement and other partners.

CoinDesk reports that Teng described attackers using Ethereum’s EIP-7702 account-delegation feature to take control of a hot wallet without the exchange’s normal approval procedures. Binance has said the attackers used a self-destruct mechanism that erased evidence, complicating the investigation. The exchange has not yet published a full account of how the breaches connected or how the attack unfolded.

Binance says the affected wallet was its own hot wallet, used for transactions, and that it found no evidence of a private-key leak. That distinction matters because the exchange says most user assets are held in cold wallets, which are offline. But CoinDesk notes that the compromised wallets had previously appeared in data describing assets backing customer balances. The investigation will need to clarify how that accounting relates to Binance’s claim that customer funds remain safe.

How does this compare with earlier exchange hacks?

At an estimated $6.36 billion, the incident exceeds the $1.5 billion Bybit hack in February 2025, which AP identifies as the previous largest crypto theft by dollar value. Binance founder Changpeng Zhao has cautioned that dollar comparisons do not settle every measure: he said the Mt. Gox theft had a greater impact in bitcoin terms. The distinction shows why rankings can shift with asset prices and the measure used.

The recovery figures also describe different things. Binance says about $3 billion has been frozen on-chain, while its reserve covers more than $6.34 billion. A freeze can restrict movement of assets identified by investigators; it does not by itself establish that those assets have been returned. Binance says it will cover all losses, and AP reports that the exchange is working with issuers and blockchain firms to trace and freeze more funds.

What will show whether Binance has contained the damage?

Binance’s next steps are to finish security checks, restore withdrawals and publish more information about the breach. Teng told CoinDesk the exchange was targeting Sunday for withdrawals to resume and planned an initial proof-of-reserves update before a fuller report on Monday. Those are targets, not completed milestones. Whether the exchange meets them, how much of the frozen amount is ultimately recovered, and what its review reveals about approval controls will show how far the incident extends beyond the headline loss.