Binance Hit by Largest Crypto Theft in History: $6.36B Stolen

The cryptocurrency exchange Binance was recently struck by a staggering security breach. According to a report from blockchain analytics firm Chainalysis, attackers drained approximately $6.36 billion worth of assets from Binance-controlled wallets across ten different blockchains within a mere 20-minute window. This figure marks the largest cryptocurrency theft ever recorded, with a scale four times greater than a major exchange hack that occurred in February 2025.

The Attack Vector: A Compromised Hot Wallet Signature System

Chainalysis attributed the attack with high confidence to the North Korean hacking group known as Trader Traitor. The core of the exploit involved a vulnerability in the pre-signing authorization mechanism of Ethereum Improvement Proposal EIP-7702. By leveraging this flaw, the attackers successfully converted one of Binance's Ethereum hot wallets into an automated "draining contract," enabling the rapid, batch transfer of assets.

On the other nine blockchains, the attackers utilized more conventional signature methods to execute withdrawals. The overall forensic assessment points to a single, critical failure: the fundamental compromise of Binance's hot wallet signature infrastructure.

Breach Pathway: Possibly Originating from an Engineer's Laptop

Details from Binance's own security incident update shed light on a potential intrusion path. Preliminary investigations suggest the breach may have started with the successful hacking of a DevOps engineer's personal laptop. Attackers used this as an entry point to gain access to a critical service container, ultimately submitting the unauthorized withdrawal transactions. This pathway underscores the persistent challenges large exchanges face in endpoint security for staff and internal access controls.

  • Supply Chain Risk: Attacks targeting developers' personal devices can bypass robust external defenses.
  • Criticality of Access Control: Strict approval workflows and permission segregation for core financial operations (like large withdrawals) are paramount.
  • Hot Wallet Security: Exchanges must continuously audit and harden the signature mechanisms and underlying code of their hot wallets.

This incident transcends a simple theft; it serves as a critical wake-up call for security practices across the cryptocurrency industry. It forces all platforms to re-evaluate the security of their hot wallet architecture, the rigor of their internal DevOps processes, and their preparedness for advanced persistent threats. For users, understanding an exchange's security track record and risk controls, while managing their own assets prudently, has never been more crucial.