Zhao Changpeng, founder and chief executive of Binance
Zhao Changpeng, founder of Binance IBTimes US

Binance, the world's largest cryptocurrency exchange, lost an estimated $6.3 billion in digital assets in a cyberattack Thursday, the biggest theft the crypto industry has ever recorded and a blow that rattled markets and renewed questions about how even the best-funded platforms protect customer money.

The exchange suspended deposits and withdrawals while it works with law enforcement to secure its systems and track the stolen funds, and said about $3 billion of the crypto has been identified and frozen. Binance has pledged to cover all losses.

"The estimated total impact sits at around $6.3B," Binance said in a post on X late Thursday.

The theft dwarfs the previous record. Blockchain analytics firm TRM Labs said the haul is roughly four times the $1.5 billion stolen from rival exchange Bybit in February 2025.

Binance has not yet published a full root cause, and investigators say the picture is still developing. But company statements and independent blockchain analysis point to five factors that allowed the attack to succeed.

1. A single compromised laptop opened the door

Binance's own early findings point to a familiar weak spot: a person's computer.

Binance said an attacker appears to have used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawal transactions.

Co-CEO Richard Teng said the company's initial review indicated "this security incident may have started with a compromised DevOps engineer's laptop."

DevOps engineers typically manage the software systems that keep a platform running, which can give their machines privileged access to sensitive internal infrastructure. Security experts have long warned that such employees are high-value targets for phishing and malware.

2. The breach went deeper than one machine

By Friday, Binance indicated the problem was broader than first thought. In an investigation update posted on X, the exchange said that while its first findings pointed to a laptop, "our subsequent investigation has uncovered additional points of breach."

TRM's analysis supports that view. The firm found that Binance wallets on 10 different blockchains, using different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. TRM concluded the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system approve transactions of its choosing across chains.

Teng said on X that the attack was not a "one-click" action but a complex process.

3. Hot wallets held enormous sums online

Exchanges keep a portion of customer funds in so-called hot wallets, which stay connected to the internet so withdrawals can be processed quickly. That convenience comes with exposure.

Binance held roughly $144 billion in assets on its platform before the hack, according to DefiLlama data. TRM found that individual hot wallets carried staggering balances. A single Binance Bitcoin hot wallet sent 18,270 BTC to the attacker, and one Ethereum transaction alone moved 167,464 ETH plus 1.615 billion USDT.

Sean Foley, a crypto markets expert at Macquarie University in Sydney, told Al Jazeera that "the larger the exchange's holdings, the larger a target it becomes."

4. A new Ethereum feature was turned into a weapon

On Ethereum, the attackers exploited a relatively new tool. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet hand control to a smart contract by signing an authorization.

The attacker submitted one transaction containing 50 authorizations signed by a Binance hot wallet, each pointing it to a "sweeper" contract that answered only to the attacker. Because the wallet processes a constant stream of withdrawals, preparing signatures for 50 consecutive transaction counts guaranteed one would still be valid when executed.

The delegation stayed in place after the first drain. As new funds reached the hot wallet, the attacker swept them again at least six more times over the following hours. TRM urged exchanges to configure signing systems to reject unexpected authorizations of this type.

5. A patient, state-backed adversary

The attack bore the hallmarks of a well-resourced, disciplined team. TRM attributed the theft with high confidence to TraderTraitor, a North Korean hacking unit the FBI previously blamed for the Bybit heist.

The groundwork was laid well in advance. TRM said preparations began at least 36 hours before the theft, with the attackers using the crypto mixing service Tornado Cash to fund their wallets. The operator tested its code on two wallets, rehearsed the final version on a third, and installed it on a Binance hot wallet four hours later.

When the strike came, it was fast. Most of the $6.36 billion moved in roughly 20 minutes starting at 20:05 UTC on Oct. 29.

The hackers then raced to outrun freezes. They sold about 325 million USDT to market makers at a discount of more than 10% and borrowed ETH against stablecoins on the lending protocol Aave, converting assets issuers could freeze into ones they could not.

Freezes, market fallout and what comes next

Stablecoin issuers moved quickly. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze roughly $30 million more. Still, the attacker controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond any issuer's reach.

Markets reacted sharply. Bitcoin fell 4% to $77,465.05, ether dropped 4% to $2,239.80, and Binance's own BNB token slid 5% to $702.28.

Binance sought to calm customers. "Rest assured that user funds are completely safe," the company said in a statement to TechCrunch. Co-founder Yi He said deposits were operating normally and the exchange expected to begin restoring withdrawals within 48 hours after strengthening its withdrawal service and address controls. CoinDesk reported that Binance has arranged $6.34 billion to cover losses.

Analysts said the exchange appears able to absorb the hit. "This does not currently appear to create meaningful solvency risk for Binance," Sean Farrell of Fundstrat Global Advisors told CNBC. He said the key signals to watch are how quickly withdrawals resume and whether outflows stay orderly.

The broader industry may not escape so easily. Chris Perkins, head of Franklin Crypto at Franklin Templeton, said the attack underscores the need for stronger cybersecurity standards and closer coordination among governments.

This is not Binance's first breach. In May 2019, hackers stole 7,000 bitcoin, worth about $40 million at the time, prompting the exchange to halt transactions for a week. Thursday's losses are more than 150 times larger.

For now, investigators are tracking the remaining funds. TRM expects the next phase of laundering to run through cross-chain bridges, swap services and over-the-counter brokers, and urged exchanges to screen deposits against addresses tied to the attack.