A possibly compromised employee computer, dozens of authorisations prepared in advance, and a sequence of transfers carried out within minutes. These are some of the elements that are beginning to explain how hackers managed to steal more than US$ 6 billion from Binance, in what is already considered the largest hack in the history of cryptocurrencies.
The theft took place on Thursday the 29th and hit wallets belonging to the world's largest cryptocurrency exchange across several blockchains. According to data analysis firm TRM Labs, approximately US$ 6.36 billion was diverted, with most of the funds withdrawn within a window of just 20 minutes.
The amount is more than four times the roughly US$ 1.5 billion stolen from Bybit in February 2025, an incident that until now had been considered the largest hack ever recorded in the crypto sector.
Although Binance has not yet completed its investigation, the exchange's first statements and analyses from firms specialising in cryptocurrency tracing make it possible to reconstruct part of the operation, from its preparation to the strategies criminals used to move and attempt to preserve the stolen funds.
Attack may have started on a Binance employee's computer
The first clue about the origin of the attack was disclosed by Binance itself on Friday the 30th. According to the exchange, the initial investigation indicates that the laptop of a DevOps engineer — a professional responsible for infrastructure and systems operation — may have been compromised.
Read also: Binance loses more than US$ 6 billion in the largest hack in cryptocurrency history
That access would have allowed the criminals to reach one of the company's service containers and submit unauthorised withdrawal transactions. The exchange stressed, however, that it found no evidence of the leak of wallets' private keys, the cryptographic information used to authorise digital asset transfers.
Binance later reported that it had identified other points of compromise beyond the computer initially suspected, indicating the attack was more complex than first thought.
Richard Teng, co-CEO of Binance, stated that the criminals did not simply use the permissions of a single engineer to move the money and that the attack was not carried out with a single click. The company also said its investigation has not attributed responsibility for the incident to any employee.
While the exchange works to identify the origin of the breach, TRM Labs has managed to reconstruct part of the criminals' preparation through the movements recorded on the blockchains.
According to the firm, planning began at least 36 hours before the theft. On the morning of Wednesday the 28th, a wallet controlled by the attackers received three small transfers from Tornado Cash, a service used to make it harder to trace the origin of cryptocurrencies.
The following day, the criminals began preparing and testing code that would be used in the operation. TRM identified tests on different wallets, including a rehearsal with the final version of the code approximately four hours before it was deployed on a Binance wallet.
This preparation indicates the attack was not an improvised attempt, but an operation planned to allow the simultaneous withdrawal of funds from different addresses.
How the hackers managed to withdraw billions of dollars in minutes
The theft began at around 5:05pm on Thursday the 29th, Brasília time, when five Binance wallets on the XRP Ledger network transferred approximately 233.46 million XRP to a single address controlled by the attacker.
Minutes later, exchange wallets on the Solana and Optimism networks also began sending funds to addresses linked to the criminals.
At around 5:20pm, a Binance Bitcoin wallet transferred 18,270 BTC, valued at roughly US$ 1.47 billion. The funds were immediately split into smaller transfers, mainly of 1,000 and 100 BTC, a strategy that makes tracing the cryptocurrency harder.
Almost simultaneously, another Binance wallet, this time on the Tron network, sent 612.7 million USDT and 46.4 million TRX to the attackers.
But it was on the Ethereum network that the most sophisticated part of the attack took place. The criminals exploited a feature known as EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025.
This technology allows a conventional wallet to authorise smart contract code to execute on its behalf. It is a legitimate network feature, designed to expand wallet functionality, but one that can be exploited if an attacker obtains improper authorisations.
According to TRM Labs, the criminals managed to prepare 50 authorisations in advance, signed by one of Binance's wallets. All of them directed control of certain operations to a smart contract run by the attacker.
The high number of authorisations served a specific purpose. Each one corresponded to a different transaction counter of the wallet, known as a nonce. Because the Binance wallet was processing withdrawals continuously, that counter changed rapidly. By preparing 50 possibilities, the attacker increased the chances that at least one authorisation would be valid at the moment of execution.
The strategy worked. One of the authorisations was accepted, allowing the criminals to take control of that wallet's operations through the malicious smart contract.
Just three minutes and 24 seconds later, the attacker executed a transaction that withdrew 167,464 ETH and 63 other tokens from the wallet, including approximately 1.615 billion USDT.
The malicious code remained active and allowed the criminals to withdraw further funds that subsequently arrived at the same address. The compromised wallet also had permissions linked to another Binance account, which made it possible to divert 823 million USDC.
The mechanism used on Ethereum, however, does not on its own explain the scale of the attack.
Other Binance wallets, spread across different networks, carried out transfers with valid cryptographic signatures, without using the same Ethereum feature.
For TRM Labs, this indicates the criminals likely managed to compromise the infrastructure Binance uses to authorise transactions on its internet-connected wallets, known as hot wallets.
In other words, the main hypothesis is that the hackers managed to get the exchange's own systems to authorise fraudulent transfers, rather than simply stealing the private keys of a single wallet.
This interpretation is consistent with Binance's preliminary statement that no evidence of leaked private keys was found. However, it remains unclear how the criminals managed to obtain the various authorisations needed to execute the transactions.
In total, TRM Labs identified fraudulent movements across ten blockchains, including Ethereum, Bitcoin, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon.
The transfers identified by the firm totalled approximately US$ 6.36 billion, of which around US$ 3.79 billion was concentrated on the Ethereum network. Besides the Bitcoin and XRP amounts, the attack involved billions of dollars in stablecoins, such as USDT, USDC and RLUSD.
What happened to the US$ 6 billion stolen from Binance
After the funds were withdrawn, a second phase of the operation began: the attempt to move the cryptocurrency before the companies responsible for the assets and network security mechanisms could block it.
This race was particularly important for stablecoins. Unlike Bitcoin and Ethereum, some of these digital currencies have mechanisms that allow their issuers to freeze amounts held at specific addresses.
As soon as the suspicious movements were identified, companies such as Tether, Circle, Ripple and World Liberty Financial began freezing the tokens associated with the attack.
TRM Labs identified approximately US$ 2.7 billion in frozen assets within the first few hours, including measures adopted by Arbitrum's security council. Binance later reported that the total amount blocked had reached approximately US$ 3 billion.
The attackers, for their part, tried to quickly convert part of the stablecoins into Ethereum, an asset that does not have the same issuer-controlled freezing mechanism.
According to TRM Labs' investigation, approximately 325 million USDT was converted into roughly 122,300 ETH through operations involving decentralised protocols and market makers. To execute these trades quickly, the criminals accepted significantly unfavourable terms compared with market prices.
In another move, the attacker deposited around 60 million USDT into the Aave lending protocol and used those funds as collateral to obtain approximately 19,760 ETH.
The move led Aave to adopt emergency security measures to prevent further operations involving funds linked to the theft. TRM Labs
The tracing also revealed a possible connection to hackers linked to North Korea. TRM Labs attributed the attack to the TraderTraitor group, associated with the North Korean government, with a high degree of confidence. The firm said it had identified similarities with previous attacks, including the advance preparation of transactions and the use of services designed to hinder the tracing of cryptocurrencies.
The same group was blamed by the FBI for the theft of approximately US$ 1.5 billion from Bybit in February 2025.
Elliptic, another firm specialising in cryptocurrency tracing, also identified evidence pointing to the involvement of criminals linked to North Korea, including movements associated with an earlier attack on the Bitget exchange. Despite these findings, the attribution has not yet been officially confirmed by Binance. MarketScreener+1
The exchange says customers will not suffer losses and that it will cover all of them using resources from its emergency fund, known as SAFU, and the company's own money.
As a security measure, Binance temporarily suspended withdrawals, revoked authorisation for affected addresses and began working with blockchain analysis firms and law enforcement authorities to recover the assets. By Friday, deposits had already been normalised, while withdrawals remained suspended.
The company also promised to publish a full technical report once the investigation is complete, along with an updated version of its proof of reserves.
For now, the main open question is how the attackers managed to turn a possible compromise of internal systems into valid authorisations to withdraw billions of dollars from wallets spread across different blockchains. The answer could help clarify not only the largest theft ever recorded in the cryptocurrency market, but also the vulnerabilities of the custody systems used by the world's largest exchanges.
If you want to invest in cryptocurrency securely, Mercado Bitcoin is offering our readers a special benefit: use the code PORTAL250 when signing up and get a 8 EUR bonus in Bitcoin when you buy 41 EUR worth of assets. Click here to open your account.
