Record $6.3 Billion Crypto Theft Tied To Single Laptop

The cryptocurrency sector is grappling with its largest recorded theft in 18 years, as an estimated $6.3 billion was drained from the world’s biggest exchange. Initial investigations point to a compromised laptop belonging to a DevOps engineer. This breach granted the attacker access to a service container, allowing them to process unauthorized withdrawal transactions without acquiring the platform's private keys.

Prior to the disclosure, estimates placed the theft between $2.7 billion and $5.8 billion. The exchange has halted deposits and withdrawals as it conducts security reviews and collaborates with law enforcement authorities. The incident caused a sharp market reaction, with bitcoin sliding from a 24-hour high of $81,890 down to the $76,300 range, liquidating millions in leveraged long positions.

Rapid Freezes and Decentralized Exits

Centralized stablecoin issuers quickly moved to blacklist addresses linked to the exploit, successfully freezing roughly $3 billion onchain. Tether CEO Paolo Ardoino confirmed his company froze over 1.567 billion USDT. Circle similarly blacklisted affected USDC, while Ripple intervened to lock approximately $200 million.

Jack McDonald, Ripple’s senior vice president for stablecoins, stated, “Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds.” Before the intervention, onchain data indicated the attacker traded 36 million RLUSD for 15,439 ETH, leaving 52.54 million RLUSD unfrozen in a holding wallet.

To evade blacklists, the exploiters are routing funds through decentralized exchanges to acquire Ethereum, which lacks a centralized issuer capable of freezing assets. Using Uniswap contracts, the attacker pushed massive batches of funds. Etherscan records show one relay wallet securing 20,940 ETH at 20:34 UTC. Another address collected 3,552 ETH at 20:47 UTC, followed by two more wallets taking in approximately 18,085 ETH and 16,498 ETH.

DeFi Responses and Stolen Asset Hoarding

The laundering efforts extended to Aave, a decentralized lending application. One wallet supplied $10 million and later $50 million in USDT as collateral to borrow 3,271 ETH and then 16,491 ETH. The aggressive strategy prompted Phylax Systems founder Odysseas Lamtzidi to warn of “contagion in full effect.” In response, Aave froze its V3 markets on the Ethereum mainnet to block further deposits and borrowing. Kamino, a decentralized finance protocol on Solana, also paused its SOL/BTC markets as a precaution.

Stolen ether is currently accumulating across several addresses rather than moving continuously. A wallet designated as Exploiter 8 held 195,460 ETH at 22:03 UTC. Another 57,891.77 ETH reached an address labeled Exploiter 11 after moving through four hops in 28 minutes. Combined, the two piles amount to about 253,000 ETH.

Platform executives, including co-founder Yi He and former CEO Changpeng Zhao, assured customers that the company and its emergency SAFU fund will cover all losses while awaiting a full technical post-mortem.