The world’s biggest crypto exchange, Binance, disclosed a massive security breach that stole roughly $6.3 billion—making it the largest cryptocurrency heist on record. U.S. authorities, including the Secret Service and FBI, are racing to track and freeze the stolen funds while Binance works to restore services and reassure customers.
Key takeaways
- The hack targeted Binance’s hot wallet by exploiting the EIP‑7702 multi‑signature protocol.
- More than $6 billion was moved out of Binance wallets in about 20 minutes.
- Investigators suspect a North Korean hacking unit, possibly "TraderTraitor," is involved.
- Withdrawal services remain paused while Binance conducts rigorous testing, expected to finish within 40 hours.
- Customers should verify account activity and follow Binance’s guidance for securing their holdings.
How the attack unfolded
Binance co‑CEO Richard Teng explained that the perpetrators abused a multi‑signature protocol known as EIP‑7702. This allowed them to bypass the usual verification steps that protect the exchange’s hot wallet—a wallet used for daily transaction processing. Once inside, the attackers employed a “self‑destruct mechanism” that erased tooling and traces as they moved the funds.
According to Binance, the bulk of the stolen crypto left the exchange’s wallets within roughly 20 minutes. The speed of the exfiltration suggests a well‑coordinated operation rather than a single individual.
Who might be impacted?
Binance states it has begun recovering some of the assets, but the full extent of user impact remains unclear. If you hold Binance balances—whether on the spot market, futures, or savings products—you should assume you could be affected until proven otherwise.
Analysts have linked the attack to a North Korean hacking unit, citing similarities to previous thefts attributed to the regime. The group is believed to use crypto theft to fund weapons programs, raising geopolitical concerns alongside the financial loss.
What Binance is doing
The exchange has taken several immediate steps:
- Paused all withdrawal services while “rigorous testing” is completed (targeted within 40 hours).
- Committed to publishing a full proof‑of‑reserves report by the following Monday.
- Started sharing an initial view of the incident with regulators and partners.
U.S. agencies—including the Secret Service and FBI—are working “around the clock” to trace, freeze, and recover the stolen assets. They are also coordinating with international partners to follow the money as it moves across blockchains.
What this means for you
If you have a Binance account, take the following actions now:
- Check your balances and recent activity. Log into the official Binance website or app and review transaction history for any unauthorized movements.
- Enable all available security features. Activate two‑factor authentication (2FA), use a hardware security key if possible, and set withdrawal whitelist addresses.
- Secure your email. Ensure the email linked to your Binance account is protected with a strong password and 2FA, as compromised email can lead to account takeover.
- Stay informed. Follow Binance’s official communication channels for updates on the withdrawal service status and recovery progress.
- Consider diversification. If you keep large amounts of crypto on an exchange, think about moving a portion to a hardware wallet you control.
What happens next
Law enforcement will continue tracing the blockchain transactions, aiming to freeze wallets linked to the theft. Binance’s upcoming proof‑of‑reserves report should provide transparency on the current state of its assets. Users should monitor the exchange’s announcements for when withdrawals are restored and for any compensation or remediation plans that may be announced.
Key takeaways (repeated for quick reference)
- Largest crypto hack ever: ~$6.3 billion stolen.
- Attack leveraged a flaw in EIP‑7702 multi‑signature protocol.
- North Korean actors are the leading suspect.
- Withdrawals are paused; testing to finish within ~40 hours.
- Users should verify accounts, tighten security, and stay updated.
Frequently asked questions
How can I tell if my Binance account was hacked?
Log in to Binance, review your balance and recent transaction history for any unauthorized transfers.
What is the EIP‑7702 protocol that was exploited?
EIP‑7702 is a multi‑signature protocol intended to add security to hot wallets; the hack bypassed its verification steps.
When will Binance resume withdrawals?
Binance says rigorous testing of the withdrawal system should be completed within about 40 hours, but exact timing may vary.
Is North Korea definitely behind the Binance hack?
Investigators suspect a North Korean hacking unit, but the attribution is not yet confirmed.
Should I move my crypto off exchanges after this hack?
Consider storing large amounts in a personal hardware wallet for added control, but keep an eye on Binance’s recovery updates.
