TLDR:
Last Thursday, on the 29th October, North Korean hackers stole around $6.3bn from Binance in the biggest crypto hack ever, 4x larger than ByBit’s hack!
They got in through a four-month campaign that included a tampered download, a fake job interview and one of Binance’s own internal AI tools.
Stablecoin issuers like Tether and Circle froze billions within hours, and Binance says it has already replaced 98% of what was taken.
Binance users look set to lose nothing and the market barely moved, a sign of how much better the industry has become at handling hacks.
Last week saw the largest crypto hack in history with Binance being hacked for over $6bn worth of assets. In fact this is probably the largest single Internet heist ever and is therefore a historic event, albeit an incredibly unfortunate one.
Impressively a lot of key players like Circle and Tether reacted quickly freezing the USDC and USDT stolen, and Binance has already made everyone whole, plus the market seems to have mostly shrugged the whole event off price-wise. Therefore, in many respects this event spoke to both the worst and the best of the crypto space and so I had to write about it this week.
This blog goes out weekly to over 20,000 subscribers. Please message me if you’re interested in sponsorships or partnerships.
And if this post resonates with you and you enjoy the content then please share it with a friend and get rewarded for doing so!
YieldSeeker is your onchain AI financial manager. Use specialised onchain agents to manage DeFi activity such as earning yield, without constantly monitoring positions yourself. Your funds remain non-custodial as agents operate through secure smart-wallet infrastructure within the permissions you set. YieldSeeker agents monitor opportunities and risk around the clock, while you retain control over your funds.
Binance's $6.3bn Hack
Last Thursday, on October 29th, billions of dollars started flowing out of Binance’s hot wallets, the internet-connected wallets exchanges use to process customer withdrawals.
Within minutes, onchain analysts on X spotted the outflows, and within the hour it was clear Binance was being hacked. Binance’s founder CZ was one of the first to say it publicly.
Binance puts the total at around $6.34bn, taken across Bitcoin, Ethereum, Solana, Ripple and several other blockchains.
That makes it the single largest crypto hack in history in USD terms, roughly four times the $1.4bn stolen from Bybit in February 2025, which I covered in a similar post at the time.
Arkham, the blockchain analytics platform, grouped the hacker’s addresses together under one profile, which showed over $5.7bn sitting across 55 addresses on the day of the attack, which grew to 10,000 addresses as the hackers started moving money around.
On Tuesday this week, Binance published an initial report explaining how it happened, opening with an apology: “This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.”
How It Happened
This was a highly sophisticated attack. Nobody stole Binance’s private keys, instead the attackers spent four months working their way inside the company until they could make Binance’s own systems sign the transactions for them.
Binance describes it as “a sophisticated, multi-stage campaign”, and laid out four main stages:
June: a Binance engineer working on its wallet systems searched online for a popular AI coding tool and downloaded a tampered installer. Binance’s security team caught it and replaced his laptop, but the attackers now knew who worked on the wallet team.
September: a second engineer was approached on a legitimate job-hunting site by someone posing as a project director. After a live video interview with a fake HR representative, and a second interview with a fake CEO, he was asked to download a coding “assignment” onto his work computer. It contained brand new malware that Binance’s security software didn’t detect.
October 20th: from that computer, the attackers used one of Binance’s internal AI tools to take control of two more engineers’ machines, and found a permission token that let them launch software on Binance’s systems.
October 29th: they used those stolen credentials to reach the internal service that signs Binance’s withdrawals, and started signing their own.
The fake job interview is a classic North Korean tactic, and Binance says it blocked 57 suspected North Korean attacks this year alone, many using exactly these methods. This one simply went on for long enough to find a way through.
The theft itself started at 20:05 UTC on the 29th October, when five Binance hot wallets sent 233 million XRP to the attackers, followed by large amounts of Solana, Optimism and 18,270 Bitcoin.
On Ethereum, the attackers used a feature called “EIP-7702”, added to Ethereum last year, which lets an ordinary wallet hand over control to a piece of smart contract code. They used Binance’s signing service to give their own contract control of one of Binance’s hot wallets and then emptied it.
That made the attack much harder to stop. Even after Binance paused withdrawals, the EIP-7702 permission was recorded on the blockchain itself, so the attackers could keep using it without going through Binance’s systems at all.
Binance’s wallets also use “Multi-Party Computation”, or MPC, where a wallet’s key is split across several machines so no single person or device ever holds it.
That’s normally a security strength, but it meant there was no single key Binance could use to quickly cancel the permission. Its team had to build a special procedure, and the last unauthorised transfer didn’t happen until almost four hours after the attack began.
The Freezes
Almost half of the stolen funds were stablecoins with around $1.7bn in USDT and $824m in USDC. Unlike Bitcoin or ETH, these stablecoins are issued by companies, Tether and Circle, which can freeze tokens held at any address. And they moved fast.
Tether froze the main receiving address about 40 minutes after the drain began, eventually freezing most of the USDT.
While Circle froze 823 million USDC “in coordination with law enforcement”.
In total, Binance says almost $3bn has been frozen or intercepted, so the attackers walked away with less than half of what they took!
The attackers knew this was coming, and raced to swap their stablecoins into ETH on Uniswap, since ETH has no company behind it that can freeze it. They also deposited around $60m of USDT into Aave, one of the largest lending protocols, and borrowed ETH against it.
Aave responded by freezing its main lending markets so no new deposits or borrowing could happen, while still letting users withdraw and repay. Kamino, a lending protocol on Solana, paused its markets as a precaution too.
The same power that let Tether and Circle save billions for Binance is also what crypto purists criticise about them, since it means any USDT or USDC holder can also be frozen. This week that power was very clearly a good thing though!
North Korea
On October 31st, two days after the hack, the FBI announced that North Korea was responsible, specifically a state-sponsored hacking group called “TraderTraitor”. It’s the same group behind the Bybit hack, and part of the wider “Lazarus Group” umbrella, a state-sponsored serial North Korean crypto hacking group.
Blockchain analytics firms TRM Labs and Chainalysis had already pointed to North Korea the day before. Chainalysis even spotted funds from September’s $388m hack of Bitget, another major exchange, mixing with the stolen Binance funds, suggesting the same attackers were behind both.
According to the FBI, the hackers are now converting the stolen assets mainly into ETH, which it expects them to launder through DeFi protocols and instant swap services. After Bybit, the same group swapped most of its stolen ETH into Bitcoin through a cross-chain swap service called Thorchain, so a similar pattern may follow.
The 18,270 stolen Bitcoin, worth around $1.4bn, were split across 19 fresh addresses most of them holding exactly 1,000 BTC.
Since Bitcoin can’t be frozen, the hackers have already started laundering some of the Bitcoin they swapped into, mixing it through “CoinJoin” transactions, which pool many people’s Bitcoin together so it’s hard to tell whose coins went where.
TRM Labs expects the rest to move through cross-chain bridges, swap services and over-the-counter brokers, while analytics firms flag the addresses to exchanges so they can’t easily be cashed out.
Exchange Hacks
Sadly Binance wasn’t the only one hit. In the days that followed, attackers drained around $46m from Mercado Bitcoin, Brazil’s largest exchange, and the onchain investigator ZachXBT reported a suspected $106m+ loss at an unnamed European company.
Hackers also stole from merchants running outdated versions of BTCPay, a self-hosted Bitcoin payment tool, and hijacked a dozen DeFi websites through their domain provider to drain visitors’ wallets.
None of these appear to be connected, and the same playbook helped again, with Tether freezing funds tied to the Mercado Bitcoin hack and the exchange saying its clients lost nothing.
Exchange hacks have been part of crypto from the very beginning:
Mt. Gox (2014) lost around 650,000-850,000 Bitcoin, collapsed, and its users waited a decade before repayments finally started in 2024.
Bitfinex (2016) lost around 120,000 Bitcoin, and every user took a 36% haircut on their balance, with them releasing a token called BFX to compensate.
Coincheck (2018) lost around $530m in NEM tokens.
Binance itself lost 7,000 Bitcoin in 2019.
Bybit (2025) lost $1.4bn, the largest hack in the space until last week.
In the early days, a hack like this would have meant the end of the exchange and huge losses for its users. This time Binance is covering every loss from its “SAFU” emergency fund, its insurance fund and its own company money!
By October 31st it said 98% of the stolen assets had already been replaced and withdrawals reopened on Sunday!
All of this being verifiable on their “Proof of Reserves” page.
Impressively after all was said and done, Binance even saw inflows of funds rather than people removing funds!
The market barely flinched either. Bitcoin dipped less than 5% still holding above $76,000! And around $1.5bn of leveraged positions were liquidated, compared with the $19bn wiped out in the 10/10 crash last year.
My personal read is that this week showed both the worst and the best of crypto. The worst was a state-backed hacking group spending four months working its way inside the world’s largest exchange to pull off the biggest theft in the industry’s history, with four more hacks landing in the days after!
The best was everything that came next: onchain analysts diagnosed it within the hour, stablecoin issuers froze billions, DeFi protocols closed off escape routes, the attackers were named within two days, and users were made whole within a few days too.
Binance has even published the details of how it was hacked, saying “security improves when the industry learns together.” As attackers like North Korea get more ambitious, the defence keeps getting faster and more coordinated too.
Centralised exchanges getting hacked is as old as crypto itself, and the one lesson that never changes is “not your keys, not your coins”. Binance could absorb a $6.3bn loss, but most exchanges wouldn’t be able to, which is why it’s still worth keeping the bulk of your crypto in a wallet you control.
Most importantly, crypto is always being tested by its hackers, and each time it seems comes back stronger!
Whenever you’re ready, these are the main ways I can help you:
Want high crypto returns? Earn up to 14% APY with your own Yieldseeker agent!
Love Web3 & AI? Follow @afoxinweb3 on X for insights!
Entrepreneur using AI? Join our AI community to accelerate your results!