Binance says $6.34B hack exploited wallet-signing service
Binance says attackers moved $6.34 billion from hot wallets after breaching its signing service; the exchange says company funds will cover losses as recovery continues.
Uruguay Can Editorial
Binance’s hot wallets handled routine transfers; on Oct. 29, attackers exploited its wallet-signing service to move about $6.34 billion in digital assets, in what may be the largest crypto theft by dollar value. In its initial incident report, published Nov. 3, Binance said it would cover the loss with company funds, not customer assets.
How did attackers get access to Binance’s wallets?
Binance says the attackers gained unauthorized access to an internal wallet-signing service, which let them initiate transactions outside the normal withdrawal process. The exchange’s report describes a campaign that began with a fake job interview and malicious software on an employee’s computer; the attackers later used an internal AI tool and stolen credentials to reach the wallet infrastructure. They then exploited Ethereum’s EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a hot wallet.
That mechanism matters because suspending withdrawals could not by itself cancel permissions already recorded on-chain. Binance says attackers moved assets across several networks, including XRP, Solana, Optimism, Bitcoin and Ethereum, before the exchange revoked the unauthorized permissions.
How much was stolen, and what was recovered?
Binance put the impact at about $6.34 billion and said roughly $2.85 billion had been frozen or intercepted as of its Nov. 3 update. The Associated Press reported that blockchain firms attributed the attack to TraderTraitor, a North Korean hacking unit; Binance said it was working with law enforcement to confirm the attackers’ identity. The AP also noted that the dollar total would exceed the $1.5 billion Bybit theft in 2025.
Binance says it set aside more than the amount needed to cover the loss and had replenished 98% of affected token assets by Oct. 31, with the remaining, less-liquid assets still being purchased. That is the exchange’s stated response; its report says the investigation is ongoing and independent cybersecurity experts will review its findings.
Sources
- initial incident report — binance.com