Skip to main content
Uruguay Can

News from across crypto

Binance traces record $6.3B theft to hot-wallet breach

Binance says hackers stole about $6.3 billion from its hot wallets on Oct. 29; it has frozen assets, pledged to cover the loss and detailed the attack.

Uruguay Can Editorial

Binance traces record $6.3B theft to hot-wallet breach

Before Oct. 29, Binance had not reported a theft on this scale. The exchange now says attackers took about $6.3 billion in token assets from its hot wallets, making the breach the largest crypto theft on record, according to blockchain analysis firm Elliptic.

In its preliminary incident report, Binance said the attackers accessed an internal wallet-signing service and initiated transactions outside the normal withdrawal process. The report says the attack involved social engineering, malware and stolen staff credentials; the investigation is ongoing, and Binance says its findings remain preliminary.

How did the attackers move funds?

Binance says an attacker used stolen credentials to deploy a container and run a malicious script. The report describes a later step involving Ethereum’s EIP-7702 authorization mechanism, which lets an account delegate some execution rights to a smart contract without revealing its private key. Here, Binance says, the attacker used that mechanism to give a controlled contract partial execution rights over a hot wallet.

That mattered because suspending withdrawals did not automatically remove authorizations already active on-chain. Binance says it had to carry out additional transactions to revoke them. Its report puts the final unauthorized transfer at 2,961.9 ETH, finalized on-chain at 20:56 Brasília time on Oct. 29.

How much can users recover?

Binance says it will cover the stolen funds through its Secure Asset Fund for Users and corporate treasury. In a Nov. 3 update, the exchange said 98% of affected token assets had been replenished and that about $2.85 billion had been frozen or intercepted, subject to reconciliation and price changes.

The FBI has attributed the theft to North Korea’s TraderTraitor group, according to Associated Press reporting. For you as a user, Binance’s stated plan is to absorb the loss; the remaining question is what the continuing investigation will establish about the breach and the funds that have not been recovered.

Sources