- Binance has been hit by a hack it now estimates at around $6.3 billion, the largest in crypto history.
- A compromised DevOps engineer’s laptop may have given the attacker access, according to Binance’s first findings.
- Blockaid traced the drain to 50 signed authorizations on a single hot wallet.
The biggest crypto hack in history just transpired on the largest crypto exchange. Binance has put a number on the security incident that rocked the exchange on Thursday, October 29. In an update posted today, the exchange confirms nearly $6.3 billion was affected. This is a developing story and the figures could change as Binance and its partners keep tracing the funds.
The industry came together to freeze approximately $3 billion on-chain, which leaves around $3.3 billion out of reach at the time of writing. DeFillama states that the unrecovered portion alone is more than was stolen across all of crypto last year. It is also equivalent to how much was lost in 2023 and 2024 combined.
A Compromised Laptop Gave the Attacker a Way In
Binance’s initial findings point to a compromised DevOps engineer’s laptop. The exchange said that the attacker used the machine to reach an internal service container and push unauthorized withdrawal transactions from there. As of now, Binance states that it has found no signs that any wallet private keys were leaked, and it plans to put out a full technical post-mortem report once the facts are verified.
What is verified now is that the attack began around 4:30 P.M. ET, according to on-chain data from Arkham. Data from Arkham shows that the attacker siphoned large amounts of Bitcoin, Ethereum, Tron and Solana, among other assets. Tether CEO Paolo Ardoino confirmed on X that they froze $1.567 billion in USDT and Circle CEO Jeremy Allaire also confirmed that they froze over $800 million in USDC. Ripple, World Liberty, BitGo and Paxos also froze stolen assets, and Arbitrum’s Security Council froze around $30.5 million. The largest DeFi lending protocol, Aave, also froze its lending markets as a precautionary measure, after the attacker borrowed Ethereum against stolen USDT.
Binance has also paused deposits and withdrawals as security checks are ongoing. Binance has also revoked authorization for the affected address and is working with law enforcement and blockchain intelligence firms to recover the funds. The exchange says its SAFU emergency fund and company reserves will cover every dollar of user losses, and an updated Proof of Reserves will follow after remediation.
Blockaid Traces the Drain Back to One Hot Wallet
Blockchain security firm Blockaid has published one of the most detailed on-chain breakdowns of the attack so far. Its report centers on Binance 14, one of the exchange’s largest and busiest Ethereum hot wallets.
According to Blockaid, the attacker funded an operator address through Tornado Cash starting Oct. 28 and rehearsed the whole sequence on its own wallets with test runs of $2 to $6. At 20:20 UTC on Oct. 29, it sent a single transaction carrying 50 EIP-7702 authorizations signed with the Binance 14 key. The wallet was still processing withdrawals, so the attacker had no way of knowing which nonce would be live and signed a whole range instead. One matched. That handed control of the wallet to an unverified sweeper contract only the attacker could operate.
About three minutes later, the sweeper emptied Binance 14 of 167,464 ETH, 1.615 billion USDT and around 60 other tokens, worth roughly $2.5 billion at the time. The wallet was left holding 1 ETH. Within 12 minutes, 10 more Binance hot wallets on Ethereum, Arbitrum, Avalanche and Optimism sent funds to the same collection address. The delegation stayed active, so the attacker returned at 21:44 UTC and took another 200 million USDT in fresh deposits without a new signature.
Blockaid CEO Ido Ben-Natan said that the evidence points to compromised signing infrastructure, and he does not think a key was leaked. That fits with Binance’s account of a breached laptop and service container. Ben-Natan also drew parallels with the $1.5 billion Bybit hack of February 2025, which this incident now dwarfs several times over.
On-chain investigator ZachXBT suspects North Korea’s Lazarus Group, though neither Binance nor any authority has confirmed the attribution. Binance has asked users to rely only on its official channels for updates.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Anush Jafer
Anush is a crypto research analyst and journalist with four years of experience in the industry. He covers stablecoins, on-chain analysis, regulatory developments and macro-driven crypto narratives. He also hosts Cryptopolitan’s live market streams and podcasts.
