Binance has confirmed what blockchain analytics firm TRM Labs now puts at $6.36 billion in losses, overtaking the $1.5 billion stolen from Bybit in February as the largest hack ever suffered by a crypto exchange. The exchange's first public account of the incident, published Thursday evening, had stopped at $2.5 billion drained from an Ethereum hot wallet. By early Friday, the figure had risen to $6.3 billion as the scale of the breach across multiple blockchains became clear.
According to TRM Labs' reconstruction, the attack began at 21:05 Paris time with wallets emptied on the XRP Ledger, Solana and Optimism. At 21:20, one of Binance's best-known Ethereum hot wallets received a delegation under EIP-7702, an Ethereum feature active since the Pectra upgrade in May. The wallet was emptied three minutes later. The attacker had reportedly prepared fifty signed authorizations in advance; only one was needed to execute the theft.
Stablecoin issuers moved quickly. Tether froze 971 million USDT tied to the hacker's main wallet at 22:01, followed three minutes later by Circle, which froze 823 million USDC. Changpeng Zhao, Binance's founder, posted on X at 22:15: "User funds are safe! This does look like a hack on Binance. Thanks to Tether (~$971 million) and Circle (~$823 million) for their swift freezing. I no longer run Binance (.com). But as a shareholder, I expect all user funds to be fully covered." Ripple froze 40.5 million RLUSD at 23:01, and World Liberty Financial froze 27.8 million USD1 nine minutes later.
A second wave of transfers hit Avalanche and Polygon shortly after midnight. Aave froze its lending markets at 00:17 after the attacker deposited 60 million USDT to borrow roughly 20,000 ETH, worth about $44 million. Binance co-founder Yi He announced at 00:59 that the exchange would cover all losses and suspended deposits and withdrawals. At 01:08, Arbitrum's Security Council forced two transfers worth around $30 million from the hacker's wallet to a frozen address. "BREAKING: Arbitrum's Security Council executed a transaction to freeze about $30.5 million from the Binance exploit. Thanks to all the other signers involved," wrote on-chain investigator ZachXBT.
Binance's 03:23 security update cited a "compromised laptop of a DevOps engineer" as the likely entry point, stating: "The initial investigation suggests the incident may involve the compromised laptop of a DevOps engineer. This reportedly allowed an attacker to access a service container and submit unauthorized withdrawal transactions. We have found no evidence of a wallet private key leak." A later update, at 05:30, softened that language to "several factors." Yi He said withdrawals should resume within 48 hours.
Losses across chains
Ethereum accounted for the largest share, at $3.79 billion, including 200,630 ETH and 1.875 billion USDT. Bitcoin losses totalled 18,270 BTC, roughly $1.47 billion. Tron lost $628 million, the XRP Ledger $296 million, Solana $96 million, and Arbitrum, Optimism and Base combined $39 million, with Avalanche and Polygon adding a further $38 million. Binance had tracked $2.54 billion frozen on-chain by 00:35. Against DefiLlama's estimate of $144 billion in total Binance assets, the stolen sum represents just over 4%.
TRM Labs attributed the operation with high confidence to TraderTraitor, the unit the FBI has previously linked to the Bybit hack, a conclusion Chainalysis chief executive Jonathan Levin reached independently overnight. The firm estimates $2.4 billion in stolen bitcoin and ether, including all 18,270 BTC, sits beyond the reach of any issuer freeze. Arkham has designated the attacker's cluster of 70 verified addresses as an official tracked entity, last counting $5.88 billion across 65 tokens, of which 1.77 billion USDT has already been frozen by Tether. The hacker has not sold any bitcoin but has begun swapping UNI, PEPE and LINK for ether.
Market and exchange fallout
Bitcoin fell below $77,000 overnight, its lowest level in more than a month, while ether lost nearly 6% and Binance's own BNB token dropped more than 8%. CoinDesk data showed 24-hour liquidations exceeding $1.5 billion, dominated by long positions. One notable exception was HYPE, which rose 15% on the back of a partnership announced the same day with ICE, the parent company of the New York Stock Exchange. Market makers Wintermute and GSR said their exposure to Binance stood at less than 20% and less than 5% of equity capital respectively. Binance's SAFU insurance fund, created in 2018, holds roughly $1 billion in bitcoin. The incident brings total crypto hacking losses for the year to beyond $2.81 billion before this breach, now dwarfed by the scale of the Binance theft alone.
