Mentioned in This Article
1. North Korea crypto hack: what happened at Binance
On Thursday, October 29, attackers linked to North Korea drained roughly $6.4 billion in digital assets from Binance, the world's largest cryptocurrency exchange, in the biggest crypto theft on record. The breach set off a cross-border law-enforcement inquiry, prompted stablecoin issuers to freeze funds, and left millions of customers waiting for withdrawals to resume.
The theft began at about 4:05 p.m. Eastern time, shortly after U.S. stock markets closed. Funds left Binance's hot wallets, the internet-connected wallets that exchanges use to process routine customer withdrawals, across roughly 10 blockchains. Most of the movement was finished within about 20 minutes, a pace that left little room for any manual intervention.
Blockchain analytics firms Chainalysis and TRM Labs each put the total at close to $6.4 billion. That is more than four times the previous record, the roughly $1.5 billion taken from the exchange Bybit in February 2025. Until this week, the Bybit case had served as the benchmark for how large a single exchange compromise could become.
2. How did the Binance exploit work?
The attackers went after Binance's internal infrastructure rather than the blockchains themselves. The networks that carried the stolen assets, including Bitcoin and Ethereum, kept operating as designed; the weakness lay in the systems that a company uses to authorize and sign withdrawals.
Binance initially linked the incident to a compromised laptop belonging to a DevOps engineer. According to that early account, access to the machine may have allowed the intruders to reach a service container and trigger unauthorized withdrawals. DevOps staff hold broad technical permissions across a company's servers, which makes their devices an attractive entry point for a determined adversary.
That explanation later proved incomplete. Binance reported what it called additional points of breach, and Chief Executive Richard Teng described a more complex attack process that did not depend on the permissions of one engineer. The company said it had found no evidence that private keys were leaked. The attacker also used a self-destruct mechanism to erase tools and traces, which complicates the forensic work of reconstructing exactly how the intrusion unfolded.
For readers unfamiliar with exchange security, the distinction matters. Exchanges hold customer assets in wallets whose keys they control, so a breach of the company's own systems can be far more damaging than a flaw in a blockchain protocol. Security teams therefore layer approvals, withdrawal limits and monitoring on top of the keys, and the attackers here appear to have found a path around several of those layers at once.
3. What role did Ethereum's EIP-7702 play?
EIP-7702 is an Ethereum feature introduced in 2025 that lets an ordinary wallet temporarily run smart-contract code. It was designed to give everyday users more flexible functions, such as bundling several actions into one transaction, without requiring them to move funds into a separate contract account.
According to TRM Labs, the attacker used 50 pre-signed authorizations to turn a Binance hot wallet into a so-called sweeper contract, a piece of code whose only job is to move out everything the wallet holds. Teng said the delegation bypassed the exchange's normal approval controls, which is why the transfers were not stopped by the checks that usually govern large withdrawals.
TRM Labs was careful to separate the tool from the cause. In its assessment, the episode did not expose a flaw in Ethereum itself. Instead, it pointed to a compromise of Binance's signing infrastructure, meaning the attacker was able to produce valid authorizations because the systems that create them had already been breached.
The episode shows why features that add flexibility to wallets also widen the range of things an attacker can do once an approval process is compromised. A sweeper contract needs no special exploit of the network; it simply executes the instructions it has been given, quickly and across every asset the wallet holds.
4. Who is behind the Binance hack?
TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a hacking group linked to the North Korean state. The same group has been blamed for the Bybit heist in February 2025, and its methods in that earlier case offer a guide to what may happen to the stolen assets.
After the Bybit theft, the group converted about 84% of the stolen Ether into Bitcoin by routing it through THORChain, a cross-chain network that allows swaps between different blockchains without a centralized intermediary. Converting into Bitcoin makes the proceeds harder to freeze, since Bitcoin has no issuer able to blacklist an address.
With this attribution, North Korea's crypto haul for 2026 now exceeds $1 billion, and the Binance theft accounts for far more than all of the year's other incidents combined. The figure underlines how heavily the country's state-backed groups rely on digital asset theft as a source of funds.
Cross-chain swaps matter in cases like this because they let stolen funds change form quickly. A stablecoin can be frozen by its issuer, but once value has been swapped into Bitcoin it sits on a network where no single company can block an address, which is why investigators watch such conversions closely.
5. How is Binance responding to the theft?
Teng said Binance will cover every dollar of the losses from company funds and from its Secure Asset Fund for Users, known as SAFU, an emergency reserve that the exchange maintains to compensate customers after security events. He added that customer assets themselves were not touched.
Binance has set aside more than $6.34 billion for the effort. About $5 billion of that is already held in the same tokens that were taken, among them Bitcoin (BTC), Ether (ETH), BNB, USDC and USDT. The remainder is being purchased on the open market and through over-the-counter trades, in which large buyers deal directly with sellers to avoid moving prices.
Operationally, withdrawals are paused while systems are rebuilt and retested, and a full security review is under way. Binance has set a target of restoring withdrawals by Sunday, November 1, and publishing a full proof of reserves shortly afterward. Deposits are running normally throughout.
The approach resembles the way larger platforms have handled shortfalls before, with the company's own balance sheet absorbing the damage instead of customers. Zhao made that point explicitly, contrasting the outcome with the collapses of Mt. Gox and FTX, where users bore the losses.
6. How much stolen crypto has been frozen?
Stablecoin issuers moved quickly after the first reports of the breach, unlike in some earlier incidents. Stablecoins are dollar-pegged tokens that underpin trading on both centralized and decentralized exchanges. Because they are issued and managed by private companies, those companies can freeze them at any time.
Tether, the issuer of USDT, froze more than $1.5 billion, while Circle, which issues USDC, the second-largest stablecoin, froze about $823 million. Both acted by blacklisting the addresses holding the funds. Across all measures, roughly $3 billion has now been frozen or located.
A large share remains out of reach. The attacker still controls more than 420,000 ETH and 18,270 BTC, along with other tokens, together worth over $3 billion, and no issuer can freeze those assets. Funds continue to move through Tron and other networks. The analytics firm Elliptic estimates that the attacker holds about $3.3 billion.
The difference between frozen and unfrozen assets is therefore the main variable in how much of the theft can eventually be recovered. Tokens such as USDT and USDC can be blacklisted by their issuers, whereas Bitcoin and Ether cannot, and those two assets make up much of what the attacker still holds.
7. How did markets react to the Binance hack?
Markets proved relatively calm. Bitcoin slid to about $76,400 on Friday, a decline of roughly 4%, and more than $1.3 billion in leveraged positions were liquidated. That is a notable move but far from the kind of panic that might be expected after the largest theft in crypto history.
The contrast with 2018 is striking. A failed attack on Binance in March of that year knocked nearly 11% off the price of Bitcoin within minutes. Analysts credit today's larger and more mature market, valued at about $2.6 trillion, and spot Bitcoin exchange-traded funds that hold about 1.3 million BTC and have not been selling in a panic.
Analysts at Cantor Fitzgerald, TD Cowen and Compass Point urged clients to buy crypto-linked stocks. They framed the incident as a security failure at one company rather than a threat to the underlying technology.
The muted reaction also coincided with Binance saying early on that it would cover all losses from its own resources. Customers were told that their balances would be made whole, a message that shaped how the incident was read by traders and analysts in the first days.
8. What happens next after the breach?
Binance said it is cooperating with law enforcement worldwide, including the FBI and the U.S. Secret Service. The FBI confirmed it is aware of the incident and is coordinating with partners, while the Secret Service declined to comment. Earlier this year, a joint effort known as Operation Atlantic traced tens of millions of dollars in stolen crypto, an example of the cooperation investigators hope to draw on again.
The political reaction has begun. CFTC Chairman Michael Selig said the breach supports the case for U.S. oversight of offshore exchanges, telling an interviewer that it proves the agency's point about the crypto rules it proposed earlier this month.
Binance founder Changpeng Zhao also traded public remarks on X with Elon Musk, who appeared to mock the exchange over the hack. Zhao pointed to Binance's stake in SpaceX, which stems from its $500 million investment linked to Musk's takeover of Twitter, and said those shares are worth more than $1 billion. He argued that the theft is the largest in dollar terms but not in Bitcoin terms, and contrasted Binance with Mt. Gox and FTX, saying the exchange is absorbing the loss itself. His summary: it hurts, but the exchange will survive.
The next milestones are the planned return of withdrawals on Sunday and the proof-of-reserves publication that follows, along with further findings from the investigation into the additional breach points.