Binance’s $6.3B theft exposes the cost of hot-wallet access

Binance says attackers stole about $6.34 billion in digital assets on Oct. 29 by using its internal wallet-signing service to initiate transfers outside the exchange’s normal withdrawal process. In its initial incident report, the exchange said it had replenished 98% of the affected assets by Oct. 31; its latest update says purchases of the remaining, less-liquid tokens may take longer. The scale makes the theft larger by dollar value than the $1.5 billion Bybit breach in 2025, which the FBI attributed to North Korean hackers, according to the Associated Press account.

How did attackers get authority to move the funds?

Binance’s account describes a campaign that combined compromised employee devices, malicious software and access to wallet operations. The exchange says an employee downloaded a tampered software package in June, then another engineer was targeted in September through a fake recruitment process and a malicious coding assignment. Binance says attackers later used a compromised computer and an internal AI tool to reach other wallet engineers and obtain credentials connected to container deployment.

On Oct. 29, the attackers used the signing service to authorize transactions from Binance hot wallets. The exchange says they exploited Ethereum’s EIP-7702 authorization mechanism, which allows an account to delegate some execution rights to a smart contract without revealing its private key. Binance says five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, with further transfers involving Solana, Optimism, Bitcoin and other assets. Its report says the final unauthorized transfer settled at 23:56 UTC; Binance cleared the malicious delegation at 00:10 on Oct. 30.

Why did freezing funds and pausing withdrawals not stop it?

Binance says it froze or intercepted about $2.85 billion, but pausing its withdrawal service did not immediately stop the attack because the on-chain authorizations could operate independently of the exchange’s normal withdrawal system. The exchange also says its hot wallets use multi-party computation, so there was no single private key it could use to revoke the permissions at once. It had to develop a separate process to clear them.

The incident shows a trade-off in exchange custody. Hot wallets are connected to the systems that process transactions, while Binance co-CEO Richard Teng told AP that most user assets are held in offline cold wallets and moved to hot wallets for withdrawals. That separation can limit exposure, but the breached signing path still allowed attackers to move a record dollar amount. Recovery also varies by asset: Reuters reported that stablecoin issuers can freeze tokens such as USDT and USDC, while Bitcoin and ether have no central issuer able to freeze them. Freezing tokens can restrict their use, but does not itself mean they have been returned to Binance.

What remains to be established?

Binance says it has set aside more than enough company funds to cover the loss and had replenished about 98% of affected assets by Oct. 31. It says approximately $2.85 billion was frozen or intercepted, subject to reconciliation and market-price changes. The FBI identified North Korea as responsible and named the activity TraderTraitor, according to Binance’s report. The exchange says it is engaging independent cybersecurity firms to review its findings; its account is an initial report, and the investigation remains ongoing.

The next signals are whether Binance completes purchases of the remaining illiquid tokens, how much of the frozen assets can be recovered, and what the independent review concludes about the signing controls and response time. Binance said withdrawals would reopen in phases; its Nov. 5 update said it was progressively restoring withdrawals for more assets as security checks were completed.

Sources and documents

• initial incident report — binance.com
• Associated Press account — apnews.com