TL;DR: Binance now says North Korean hackers stole $6.36 billion from its hot wallets Thursday night, the largest crypto theft ever recorded. Blockchain intelligence firm TRM Labs attributes the attack to TraderTraitor, the same unit tied to last year’s $1.5 billion Bybit hack, with “high confidence.” Separately, blockchain researchers at CoinDesk traced 18,270 BTC, worth roughly $1.4 billion, into 19 wallets that nobody can freeze the way exchanges froze the stolen stablecoins. Binance says about $3 billion of the total has been recovered or frozen and has promised to cover every dollar of customer losses.
This is a different story than the one we ran Thursday night. Back then, Binance was calling it a possible breach and hedging everything with “investigating.” Less than 24 hours later, the hedging is mostly gone. Binance has confirmed the incident, published its own theory of how it happened, and the dollar figure has grown from an estimated $5.8 billion to a confirmed $6.36 billion at the time the assets were taken (or $6.23 billion at today’s prices, since crypto doesn’t sit still). Whichever number you use, it dwarfs the previous record. Bybit lost $1.5 billion in February 2025 and that was already the biggest crypto heist on record. This one is more than four times that size.
Who TRM Labs says did it
TRM Labs, the blockchain analytics firm that governments and exchanges lean on for this kind of forensic work, published its findings Thursday and updated them through Friday morning. Its conclusion: this was TraderTraitor, the North Korean state hacking unit the FBI already named as the group behind the Bybit theft. TRM says it’s making that call “with high confidence,” pointing to overlapping tradecraft across three incidents: Bybit, April’s KelpDAO hack, and now this one. All three share a pattern where the attacker funds an operator wallet through Tornado Cash well ahead of time, stages the operation quietly, then executes pre-signed approvals in one fast burst once everything is in place.
The mechanics TRM traced on Ethereum are specific enough to check. A Binance hot wallet signed 50 EIP-7702 authorizations, a relatively new Ethereum standard that lets a regular wallet temporarily behave like a smart contract, and those authorizations pointed to a sweeper contract the attacker controlled. Three minutes and twenty-four seconds later, that sweeper drained 167,464 ETH along with 63 other tokens. On the nine other chains Binance operates across, including Bitcoin, Tron, and Solana, the outgoing transfers look like ordinary signed transactions rather than anything exploiting EIP-7702. TRM’s read on that is that the attacker didn’t need a separate trick for every chain. They most likely got control of the signing infrastructure that approves withdrawals across Binance’s whole hot wallet system, not just one chain’s wallet.
Binance’s own account, as reported by CoinDesk, points toward how that control got handed over in the first place: a compromised laptop belonging to a DevOps engineer, which gave the attacker a way into a service container used to submit withdrawal requests. Binance says there’s no sign any private key actually leaked, and every outgoing transfer still carried a valid signature from its own addresses. That detail matters, because it means the thieves didn’t need to crack any cryptography. They just needed a way to make the system sign what they wanted it to sign. TRM, notably, hasn’t confirmed Binance’s root-cause story yet and says the company has yet to publish a full account of its own.
Why the Bitcoin can’t be frozen
The freezing race is the part of this story that’s easiest to follow, and it explains why the hacker’s next move mattered so much. Tether and Circle both control the smart contracts behind USDT and USDC, so within hours of the theft they blacklisted the addresses holding stolen stablecoins. Ripple did something similar with RLUSD. Binance says roughly $3 billion of the total haul has now been recovered or frozen this way, mostly thanks to that stablecoin issuer cooperation. It’s the same freeze-and-cooperate playbook we described when Coinbase talked up stablecoins as the payment rail of choice for AI agents: centralized issuers can act fast precisely because they still control the ledger behind their own tokens.
Bitcoin doesn’t work that way. Nobody issues it, nobody can blacklist an address, and the only chance to intercept stolen BTC is catching it when it actually lands at an exchange, OTC desk, or swap service that’s willing to cooperate. According to CoinDesk’s own trace of the blockchain, the attacker understood that distinction well. At 20:20 UTC Thursday, a Binance Bitcoin hot wallet sent 18,270 BTC, worth about $1.4 billion at the time, to a single address in eleven transactions. Within the same block and the next one, that stash got split into a peel chain of 19 wallets: seventeen holding exactly 1,000 BTC each, one holding 832.5 BTC, and one holding 437.7 BTC. As of Friday morning, none of those 19 wallets had moved a single coin since the split. The hacker is simply sitting on it, letting it cool off while the headlines move on.
Elsewhere, the money moved more visibly. Researchers including Elliptic and independent investigator ZachXBT traced part of the stolen Ethereum haul through THORChain, a cross-chain swap protocol that doesn’t require the kind of centralized cooperation stablecoin issuers can offer. On Aave, the attacker reportedly borrowed about $44.6 million in ether against stolen USDT before the protocol froze its lending markets across 16 networks to cut off further borrowing. That single move was enough to knock Aave and Uniswap tokens down roughly 11% on Thursday, which tells you how directly this hack is already reshaping DeFi risk pricing, not just Binance’s balance sheet.
The market felt it immediately
Crypto futures liquidations jumped roughly fourfold to $1.57 billion as the news spread, with Bitcoin and Ethereum positions accounting for over $880 million of that combined. Bitcoin dropped to an overnight low near $76,400, its weakest level since mid-September, before clawing back to around $77,350. Ethereum briefly touched $2,170 before recovering to roughly $2,220. Both remain down for the day. None of that moves the security story forward, but it’s a reminder of how much borrowed money sits on top of exchange trust in this market. A single breach at the industry’s largest exchange doesn’t just cost Binance money. It forces a repricing across every token that depends on Binance’s liquidity and every protocol exposed to whatever the attacker does with the funds next.
Binance, for its part, has kept deposits and withdrawals suspended and says it will cover every customer’s losses out of its own reserves. That’s a real commitment at this scale, and it’s the kind of promise only an exchange with Binance’s balance sheet could credibly make. Smaller platforms facing a breach this size wouldn’t have that option.
The bottom line
What changed between Thursday night and Friday morning isn’t just the dollar figure. It’s the shift from a possible breach under investigation to a confirmed, attributed, technically explained theft, with a specific nation-state actor and a specific exploited mechanism named by an independent research firm. The part that should worry the rest of the industry isn’t the size of the number. It’s that the attacker apparently didn’t need to steal a private key at all, just the ability to make Binance’s own systems sign what they wanted. Every exchange running hot wallets across ten chains should be asking this morning whether their own signing infrastructure could be tricked the same way.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
