World’s Largest Crypto Heist: Binance Halts Withdrawals After Record $6.3 Billion Cyberattack

Binance has suspended withdrawals on multiple networks after hackers drained approximately $6.36 billion across nine blockchains. Read the full details on the largest crypto theft in history on Urban Radio.

In what forensic blockchain investigators are calling the largest cyber theft in history, Binance, the world’s largest cryptocurrency exchange, has suspended all platform deposits and withdrawals following a massive breach that resulted in over $6.3 billion in stolen digital assets.

The attack unfolded across ten major blockchain networks, including Ethereum, Bitcoin, TRON, XRP Ledger, Solana, and Arbitrum, before Binance moved to halt network operations to contain the exploit.

How the Attack Happened: Compromised Infrastructure & EIP-7702

According to technical post-mortems from blockchain security firms TRM Labs and Bitquery, as well as preliminary statements from Binance, the breach began late on October 29 when attackers compromised internal systems:

• DevOps Compromise: Initial investigation points to a compromised laptop belonging to a Binance DevOps engineer. This enabled the attackers to gain access to internal withdrawal systems and sign unauthorized batch transfer requests without leaking core private keys.

• Ethereum Sweeper Exploitation: On the Ethereum network, the attacker utilized pre-signed EIP-7702 delegation authorizations to turn Binance’s main hot wallet into an automated sweeper contract. This allowed the hackers to drain existing balances and continuously siphon incoming user deposits over a three-hour window.

• Cross-Chain Outflows: Stolen assets included over 18,270 Bitcoin (BTC) (~$1.47 billion), hundreds of thousands of Ethereum (ETH), over 600 million USDT on TRON, and hundreds of millions in stablecoins and altcoins across Solana, Arbitrum, and Ripple.

$3 Billion Frozen in Massive Industry Coordinated Response

In response to the exploit, major stablecoin issuers and decentralized protocol teams initiated emergency freezes to block the movement of stolen funds:

• Issuers Lock Funds: Tether froze nearly $1.57 billion in USDT, Circle locked over $800 million in USDC, and Ripple froze roughly $200 million. World Liberty Financial and the Arbitrum Security Council also enacted protocol-level freezes.

• Recovery Status: Approximately $2.7B to $3 billion of the total stolen amount has been frozen or contained on-chain so far.

• Unreachable Funds: Despite the freezes, the attackers managed to swap hundreds of millions into un-freezable assets (such as ETH and BTC) via decentralized liquidity pools before locks took effect, leaving over $2.4 billion directly under hacker control.

Attribution: North Korea’s “TraderTraitor” Blamed

Leading blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor (also known as Lazarus Group), an elite North Korean state-sponsored cyber unit.

The same group was named by the FBI as responsible for the $1.5 billion Bybit hack earlier in February 2025.

Binance Guarantee: “User Funds Are Safe”

Addressing the public, Binance co-founder Yi He and company executives issued official assurances that user account balances will be protected:

“The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU (Secure Asset Fund for Users) fund and the company’s funds. User funds are safe.”

Binance stated that platform deposits and withdrawals will remain paused while security audits and infrastructure remediation continue. An updated Proof of Reserves will be published once checks are complete.