On Thursday, Binance suffered the largest crypto hack to date, with blockchain analysts calculating that more than $6 billion worth of assets were taken. Beyond the financial impact, the security breach has sparked discussions concerning the safety of centralized exchange architecture, especially the hot wallets utilized to store billions in user funds.
Binance reported that its preliminary findings pointed toward a compromised DevOps engineer laptop alongside unauthorized entry into a service container. The trading platform has not uncovered any private-key exposure, while co-chief executive officer Richard Teng characterized the incident as more advanced than a simple breach of a single staff member’s permissions.
Onchain investigators have linked the cyberattack to North Korean threat actors. Their evaluation indicates that the culprits leveraged Binance internal systems and wallet-signing procedures to transfer capital across multiple blockchain networks.
How Binance was attacked
The perpetrator began staging operations at least a day and a half before the theft, financing an operational wallet utilizing modest Tornado Cash withdrawals, according to TRM Labs. The attacker deployed and tested malicious scripts across three separate wallets prior to launching the main strike.
On the Ethereum network, the malicious actor utilized EIP-7702 to convert a Binance hot wallet into a sweeper managed by the intruder. Fifty pre-signed authorizations were prepared to guarantee that at least one remained active upon execution. TRM noted that synchronized transfers spanning nine alternative blockchains point to a breach of the broader Binance hot-wallet signing environment.
Findings from Elliptic indicate that the infiltrator maintained entry past the initial exploit, leveraging ownership rights from one compromised wallet to drain capital from a secondary Binance wallet and continuously sweep fresh deposits. An additional Ethereum hot wallet also transferred $174 million in holdings directly to the attacker, providing further evidence of access to the wider transaction-signing architecture of Binance.
Immunefi vice president Simone Imbrescia stated that the exploit demonstrates how the sophistication of an intrusion does not necessarily rely on onchain code complexity, but rather on securing entry to systems capable of approving transactions.
“One of the striking things about this breach is how little code was actually needed on-chain. The sweeper contract was only around 130 lines,” Imbrescia remarked. “The hard part sometimes is getting access to a system powerful enough to make very simple code devastating.”
Chainalysis, Elliptic, and TRM all attributed the breach to North Korean hacking syndicates, with TRM directly connecting it to the exact group associated with the $1.5 billion Bybit hack.
Chainalysis uncovered onchain connections linking the assets pilfered from Binance to gains originating from the previous month’s Bitget security incident, which was likewise blamed on North Korean cybercriminals. TRM referenced parallels to historical North Korean campaigns, including Tornado Cash financing, preliminary staging, and pre-signed authorizations. Conversely, Elliptic warned that the onchain crossover involving the Bitget event accounted for merely a minor fraction of the Binance funds and did not definitively prove the identical perpetrators were accountable.
Chainalysis documented thousands of transfers executed within a brief timeframe, with stolen capital bouncing repeatedly among different addresses. The assailant also sought to sidestep stablecoin freezes by trading $325 million in stablecoins for $285 million in ether across roughly a twenty-minute window.
Elliptic reported that the hacker deposited $59.9 million worth of stolen USDT inside Aave as collateral to borrow 19,762 ETH. That debt position stayed open and hovered near liquidation levels as of the organization’s most recent update. The intruder additionally exchanged hundreds of millions of dollars of USDT for ether via decentralized exchanges and market makers, absorbing discounts as steep as 26% relative to market valuations to shift holdings into currencies that issuers cannot freeze.
Aave announced on Friday that it lifted freezes on all markets across both V3 and V4 iterations, noting that its smart contracts remained uncompromised and user collateral positions were fully backed.
Binance’s financial position
Binance holds roughly $5 billion in impacted funds, while securing another $1.3 billion via open market and OTC channels to fulfill its pledge to absorb the losses.
Teng stated that the exchange aimed to release its initial proof-of-reserves accounting by Monday while striving to reactivate withdrawal functions.
“We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours,” Teng expressed in a video published on X on Friday.
Analysts at TD Cowen noted that the breach underscores custody and cybersecurity vulnerabilities tied to centralized trading venues rather than diminishing the wider digital asset sector.
“The evidence available so far points to a compromise of infrastructure at a centralized intermediary, rather than a failure of Bitcoin or its underlying network,” the analysts wrote. “Put differently, we do not stop using dollars when a bank is robbed, just as car theft does not invalidate the automobile.”
Imbrescia added that the event also accentuates the necessity of safeguarding platforms and workflows governing access to private keys. Web3 security initiatives frequently prioritize safeguarding keys and reviewing smart contracts, but personnel, infrastructure, and operational workflows capable of directing those keys form an essential part of the defense perimeter.
“If an attacker compromises that operational layer, they may not need to steal a key or discover an exotic smart-contract vulnerability at all,” she concluded. “The broader lesson is that access controls, internal infrastructure and transaction-authorisation processes need to be secured with the same intensity as the keys themselves.”
Originally published at https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225.
