Record $6.4B Siphoned in Largest Exchange Breach

The cryptocurrency sector has been struck by the largest theft on record, with up to $6.4 billion drained from hot wallets belonging to the world's largest exchange. Binance experienced the suspected breach when an attacker initially compromised a DevOps engineer’s laptop, gaining unauthorized access to assets across the Ethereum, Bitcoin, and Tron blockchains.

Blockchain data indicates the stolen assets originally tallied at least $5.57 billion. This initial sum included $3.51 billion on Ethereum, $1.44 billion represented by 18,270 Bitcoin, and $630 million on Tron. Later estimates placed the total closer to $6.4 billion, a figure that is more than four times the size of the previous record, a $1.5 billion heist at Bybit in February 2025. By comparison, Binance previously lost 7,000 Bitcoin, worth roughly $40 million, during a 2019 security incident.

The perpetrator utilized Tornado Cash, a protocol that obscures transaction histories, to fund an address that submitted a delegation for a Binance wallet. This maneuver leveraged EIP-7702, an Ethereum feature that permits standard wallets to execute smart-contract code. Phylax Systems founder Odysseas Lamtzidi noted on X that this persistent delegation allows code to "authorize later transfers without another signature from the wallet."

The initial Ethereum transaction occurred at 20:24 UTC, swiftly moving 167,464 ETH alongside 63 different tokens, which included 1.615 billion USDT sent to a new address.

Mitigation Efforts and Frozen Assets

Centralized stablecoin issuers rapidly intervened to mitigate the damage. Tether and Circle executed built-in freeze functions, successfully locking approximately $2.39 billion in combined USDT and USDC across attacker addresses.

"In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation," Circle CEO Jeremy Allaire stated on X.

Additional ecosystem protocols took preventative measures to safeguard liquidity. Lending platform Aave temporarily froze its V3 and V4 markets on Ethereum to prevent the attacker from borrowing against the stolen collateral. Ripple also confirmed it is assisting the exchange by freezing affected XRP tokens. Concurrently, blockchain trackers observed Ripple moving 310 million XRP, valued at $389.08 million, shortly after the breach, though it remains unconfirmed if these specific transfers are tied to the incident.

Onchain researcher ZachXBT highlighted that the stolen assets were commingled with funds from a previous $388 million Bitget exploit, suggesting the involvement of a North Korean hacking group.

Market Repercussions

The exchange paused withdrawals on multiple networks while investigating additional points of breach. Binance announced it has allocated over $6.34 billion in company reserves to cover user losses entirely. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information,” the company stated on X.

The broader market reacted sharply to the breach, triggering over $1.33 billion in liquidations. Bitcoin slid below $79,000, Ethereum dropped below $2,200, and Binance's native BNB token fell 7% to roughly $699. Conversely, the privacy-focused token Monero experienced a 6% increase to $637, echoing previous market behaviors during large-scale thefts.