The suspected theft of $6.3 billion from Binance has exposed the security risks surrounding centralised cryptocurrency exchanges, raising fresh questions about how safely billions of dollars in digital assets are held, even by the industry’s largest trading platform.
The breach, which occurred on October 29, affected Binance wallets across 10 blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred to attacker-controlled addresses, making it the largest cryptocurrency theft on record, about four times the $1.5 billion stolen from Bybit in February 2025.
Read also: Binance tightens crypto controls, restricts 3 Nigeria-linked platforms
The scale of the incident has also drawn attention to the security of exchange infrastructure, particularly the systems responsible for authorising transactions and processing customer withdrawals.
Binance’s initial investigation suggests that an attacker may have compromised a DevOps engineer’s laptop, gaining access to a service container through which unauthorised withdrawal transactions were submitted. The exchange said it had found no evidence that its wallet private keys were leaked, although it promised a detailed technical investigation after establishing the full circumstances.
Blockchain investigators identified the exploitation of Ethereum’s EIP-7702 account-delegation feature as part of the attack. The feature, introduced through Ethereum’s Pectra upgrade in May 2025, allows conventional cryptocurrency wallets to execute smart-contract code after receiving an authorised delegation.
TRM Labs said the attacker used pre-signed authorisations to turn a Binance Ethereum hot wallet into a mechanism for automatically transferring funds to an address under its control. Other affected blockchain networks recorded transfers through ordinary signed transactions, pointing to a wider compromise of Binance’s transaction-signing infrastructure.
The incident has raised questions about the concentration of digital assets in internet-connected hot wallets, which exchanges rely on to process withdrawals quickly. Although such wallets are essential to daily operations, their connection to transaction systems makes them attractive targets for attackers seeking access to large pools of cryptocurrency.
The speed at which billions of dollars moved across multiple blockchain networks also exposed the limits of existing safeguards. While blockchain transactions are publicly traceable, tracing stolen assets does not necessarily mean they can be recovered, particularly when attackers convert them into assets that cannot be frozen by central authorities.
That distinction has become central to Binance’s recovery efforts. Stablecoin issuers Tether and Circle, alongside other blockchain partners, moved to freeze assets linked to the attack. Binance said approximately $3 billion had been frozen on-chain, while TRM Labs estimated the total frozen assets at about $2.7 billion at its October 30 reporting cut-off.
Tether reportedly froze approximately $1.77 billion in USDT, while Circle froze about $825 million in USDC. Ripple and World Liberty Financial also froze assets associated with the incident.
However, Bitcoin and Ether do not have central issuers with the authority to blacklist individual wallets in the same way. TRM estimated that the attacker retained approximately $2.4 billion in assets, including more than 420,000 Ether and 18,270 Bitcoin, beyond the reach of issuer-led freezing mechanisms.
The attacker also began converting some of the stolen stablecoins into other cryptocurrencies through decentralised trading platforms and lending protocols, complicating efforts to contain the movement of funds.
Beyond the immediate recovery challenge, the breach has raised questions about the strength of Binance’s customer asset backing. A CoinDesk review of the exchange’s October 1 proof-of-reserves data found that Binance 14, the Ethereum hot wallet involved in the incident, was listed among the wallets backing customer balances.
The publication estimated that the loss of approximately 204,500 Ether could reduce Binance’s Ether reserve coverage from 100 percent to about 94 percent, based on the October 1 snapshot, until the exchange replaces the missing assets. The findings also raise questions about the adequacy of reserve disclosures between reporting periods.
Binance, however, has assured customers that their funds remain safe and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate funds. The exchange also announced the temporary suspension of deposits and withdrawals while security checks were conducted, alongside efforts to revoke the affected wallet authorisation and work with law enforcement and blockchain intelligence firms.
Changpeng Zhao, Binance’s co-founder and former chief executive, described the incident as a likely hack and said he expected customers to be fully covered, although he clarified that he no longer manages the exchange.
The market reaction underscored the broader confidence implications of the breach. Bitcoin fell below $79,000 following the incident, while Ether dropped below $2,300, as investors reassessed the security risks surrounding one of the industry’s largest trading platforms.
TRM Labs has attributed the attack, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking group previously linked to major cryptocurrency thefts, including the Bybit breach. Binance has not independently confirmed the identity of those responsible.
The incident places renewed pressure on cryptocurrency exchanges to strengthen transaction authorisation systems, separate operational access from wallet-signing privileges and improve monitoring across blockchain networks.
More importantly, it exposes a structural weakness in the cryptocurrency industry: the security of decentralised financial assets still depends heavily on the integrity of centralised institutions that hold and move them on behalf of millions of customers.
For Binance, the immediate test is whether it can replace the missing assets, maintain customer confidence and demonstrate that its security controls can prevent a similar compromise. For the wider industry, the record-breaking breach raises a more fundamental question about whether the systems protecting billions of dollars in digital assets have kept pace with the sophistication of the threats targeting them.
Royal Ibeh is a senior journalist with years of experience reporting on Nigeria’s technology and health sectors. She currently covers the Technology and Health beats for BusinessDay newspaper, where she writes in-depth stories on digital innovation, telecom infrastructure, healthcare systems, and public health policies.
