Review: Binance Loses $6.3 Billion in Record Hack as Investigators Find More Breach Points

Hackers took about $6.3 billion from Binance on Thursday, the largest crypto theft on record. As with Bybit’s $1.5 billion loss in February 2025 and September’s Bitget breach, onchain investigators pointed to North Korea backed hackers. By Friday morning, Binance said it had found more breach points after first suspecting a compromised engineer’s laptop. Co-CEO Richard Teng stressed that the attacker did not simply use one engineer’s permissions, that it was not a single one click action, and that no individual has been held responsible.

How the Attackers Used EIP-7702

Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing Binance’s normal approval controls. A self destruct mechanism then wiped out tools and traces, which has slowed the investigation. Blockaid CEO Ido Ben-Natan believes compromised signing systems made the theft possible. In his view the funds could have been stolen without the upgrade, but it may have helped the attackers bypass safeguards and drain assets in one sweep.

Laundering Activity and Reserve Funds

Chainalysis spotted thousands of rapid transactions that may point to automated laundering, with money moving between addresses and sometimes returning to wallets used earlier. Binance says it has set aside more than $6.34 billion in company funds to cover losses, including $5 billion held in the same tokens that were stolen.

Aave Reopens and Binance Withdrawals Wait

The hack rattled prices and led Aave to freeze new deposits and borrowing as a precaution. Aave reopened its markets Friday afternoon, while Binance withdrawals stay suspended. Teng said the exchange is rebuilding its withdrawal service and running a company wide security review. Binance aims to resume withdrawals within 40 hours of his Friday update and to publish a full proof of reserves report by Monday.