Binance on Thursday suffered what investigators describe as the largest crypto-asset theft to date, with blockchain analytics firms estimating that more than $6 billion was stolen. Binance said about $5 billion in assets were affected and that it is raising a further $1.3 billion through market and over-the-counter channels to meet its commitment to cover the losses. The incident puts the exchange’s asset safeguards and withdrawal plans under scrutiny, while raising questions about the security of hot wallets and transaction-approval systems at centralized platforms holding large amounts of customer funds.
Probe points to preparation at least 36 hours before the theft
Binance’s initial investigation suggests the attack may have involved the compromise of a DevOps engineer’s laptop and unauthorized access to a service container. The exchange said it had found no evidence that private keys were exposed. Binance co-CEO Richard Teng said the attack was more complex than the theft of an individual employee’s credentials.
TRM Labs said the attackers began preparing at least 36 hours in advance. They funded operational wallets with small withdrawals from Tornado Cash, then deployed and tested malicious code involving three wallets. During the attack, they used Ethereum’s EIP-7702 to turn a Binance hot wallet into a tool for consolidating funds under their control. They had prepared 50 signature authorizations in advance to ensure that at least one would remain valid when the attack was carried out.
The attackers also coordinated transfers across nine other blockchains. TRM said the cross-chain activity suggests the exposure may have extended beyond a single wallet to Binance’s broader hot-wallet signing infrastructure. Elliptic said the attackers may have retained access after the initial exploit, using owner permissions on a compromised wallet to withdraw funds from another Binance wallet and continuing to move newly deposited assets. A separate Ethereum hot wallet also sent $174 million in assets directly to the attackers, intensifying questions about the scope of access to the exchange’s transaction-signing systems.
Investigators focus on access to transaction approvals
The complexity of the attack may not have been in the on-chain code itself, said Simone Imbrescia, vice president at Immunefi. The fund-consolidation contract involved had about 130 lines of code, she said; the critical issue was how the attackers gained access to infrastructure capable of approving transactions, allowing relatively simple code to cause substantial losses.
Chainalysis, Elliptic and TRM have attributed the attack to a North Korean hacking group. TRM said the activity was linked to the group involved in the roughly $1.5 billion Bybit attack in 2025. Chainalysis identified an on-chain connection between funds stolen from Binance and proceeds from last month’s Bitget incident, which was also attributed to North Korean hackers. Elliptic cautioned that the overlap covered only a small portion of the Binance theft and was not enough to establish that the same attackers were responsible for both incidents.
Investigators also found that the attackers initiated thousands of transactions in a short period, moving funds repeatedly between addresses. To reduce the chance that stablecoin issuers could freeze the assets, they converted $325 million in stablecoins into about $285 million in ETH over nearly 20 minutes.
Stolen funds moved into Aave as some trades took a discount
Elliptic said the attackers deposited $59.9 million in stolen USDT on Aave as collateral and borrowed 19,762 ETH. At the analytics firm’s latest update, the loan remained unpaid and was close to liquidation. The attackers also used decentralized exchanges and market makers to convert hundreds of millions of dollars in USDT into ETH. Some trades were made at discounts of up to about 26% against market prices as they shifted into assets that issuers cannot freeze.
Aave said on Friday that it had lifted the freeze across all markets on its V3 and V4 protocols. The company said its smart contracts were unaffected and user positions remained adequately collateralized. The Binance incident concerns access to the platform’s signing systems; whether Aave’s own contracts were affected is a separate question. Aave’s statement addressed the status of its protocols and users’ positions.
Binance raises $1.3 billion and plans proof-of-reserves update
Binance said about $5 billion in assets were affected and that it was securing another $1.3 billion through market and over-the-counter transactions to cover the losses. Teng said the exchange planned to publish an initial proof-of-reserves report on Monday and was working to restore withdrawals. In a video posted on Friday, he said Binance hoped users would be able to withdraw before Sunday’s deadline and that its target at the time was to restore the relevant arrangements within about 40 hours.
TD Cowen analysts said the available evidence points to an intrusion into the infrastructure of a centralized intermediary, not a failure in Bitcoin or its underlying network. The immediate questions remain Binance’s handling of affected assets, the restoration of withdrawals and the details of its reserves. Investigators have yet to establish how the attackers entered internal systems, whether the signing process was broadly affected or whether the stolen funds can be recovered.
Imbrescia said crypto security cannot focus only on private-key custody and smart-contract audits: the people, infrastructure and operational processes able to invoke keys are also part of the security boundary. An attacker who controls that operational layer may not need to steal private keys directly or exploit a complex contract vulnerability. For Binance users, the exchange’s withdrawal-restoration timeline, proof-of-reserves report and coverage of the losses remain the key developments to watch.