The world's largest cryptocurrency exchange was hacked, resulting in the theft of 6.3 billion US dollars.

On October 30 local time, Binance, the world's largest cryptocurrency exchange, publicly confirmed that cryptocurrency assets worth 6.3 billion U.S. dollars had been stolen by hackers.

This is the largest cryptocurrency theft case in recorded history.

The news sent shockwaves through the crypto market, with Bitcoin prices dropping to a six-week low of around $76,000 per coin at one point. On the same day, U.S. President Donald Trump publicly stated that the U.S. government is investigating the hacking incident on Binance.

Binance was founded by Changpeng Zhao and Yi He in 2017, and officially launched its trading platform in July of the same year. The company grew into the world's cryptocurrency exchange with the largest trading volume in just a few years, and further consolidated its leading position after FTX, the world's second-largest cryptocurrency exchange and its main competitor, collapsed in November 2022.

However, in the past few years, Binance has been caught in legal disputes in many regions around the world. In 2023, Binance pleaded guilty to violating U.S. anti-money laundering laws and paid a $4.3 billion fine to the U.S. government. Changpeng Zhao was sentenced to four months in federal prison. After being released, Changpeng Zhao was pardoned by Trump. Virtual currency trading is explicitly banned in mainland China.

Binance is trying to boost market confidence. According to its disclosure, about half of the affected assets have been frozen on the blockchain network, but more than half are still in the hands of hackers, and the company has promised to "cover all losses" with its own funds. As of press time, Binance said it has replenished 90% of the stolen assets, and withdrawals are expected to resume on Sunday.

But Cristiano Ventricelli, Vice President of the Decentralized Finance and Digital Assets Division at Moody's Ratings, told *Caijing* that this incident highlights that the cybersecurity risks associated with hot wallets are rising — a hidden danger that was already exposed when the Bybit cryptocurrency exchange was hacked previously. It also reveals the inherent risk concentration problem of large centralized intermediaries. While stricter institutional control can reduce some risks, the scale of custodial assets may amplify the impact of an intrusion.

According to information released by the Federal Bureau of Investigation (FBI), in February 2025, hackers stole approximately 1.5 billion U.S. dollars from Bybit, a Dubai-headquartered cryptocurrency exchange. Before this attack, this was the largest cryptocurrency theft on record.

In Cristiano Ventricelli's view, the broader credit and industry impact of the Binance attack will depend on the final loss amount, affected counterparties, asset recovery status, and most critically, whether the incident will cause cascading chaos or a collapse of confidence across the entire digital asset ecosystem.

01

$6.3 Billion Transferred in 20 Minutes

On October 29 local time, an attacker transferred approximately 6.3 billion U.S. dollars from Binance wallets distributed across ten blockchains including Ethereum, Bitcoin, TRON, Ripple, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon, involving multiple completely different underlying signature systems.

What draws attention is that most of the cryptocurrencies were transferred in just 20 minutes. This means that the fight against hackers is a "race against time".

Binance's preliminary investigation shows that a DevOps engineer's laptop was breached, through which the attacker gained access to the service container and submitted unauthorized withdrawal transactions. Later, Binance discovered other security vulnerabilities, but claimed there is no evidence that private keys were leaked.

After reviewing the whole process, blockchain analysis firm TRM Lab believes that the attack preparation started at least 36 hours before the theft. The attacker's operational wallet received three small withdrawals from Tornado Cash starting on the morning of October 28, and Tornado Cash is a service that hides the source of cryptocurrency. In the early morning of October 29, the operator deployed the first part of the attack code and tested it on two wallets. Later that day, they rehearsed the final version on the third wallet, then transferred the test funds back to their own wallet. Four hours after the rehearsal, the same code was installed in one of Binance's hot wallets.

A hot wallet refers to a wallet connected to the Internet, which exchanges use to process customer withdrawal operations, and the Ethereum hot wallet is one of Binance's most well-known wallets.

This attack exploited the EIP-7702 delegation, a mechanism introduced in a major Ethereum network upgrade in May 2025 that allows ordinary wallets to sign a power of attorney to hand over control of their actions to smart contracts. After that, every call to the wallet will run the code of the contract, and this arrangement will remain valid until the wallet signs a new power of attorney.

From the early signs of activity on Ethereum, TRM Lab speculates that the attacker may have stolen the authorization information on Ethereum through phishing. During the same period, five Binance wallets (located on the XRP Ledger, Arbitrum, Avalanche, Optimism and Base chains respectively), one Binance Bitcoin hot wallet, one Binance Tron hot wallet and one Binance Solana wallet sent funds to the attacker through standard signature transfers. Another Binance Ethereum hot wallet also sent 28006 ETH, 55.7 million USDT and 25.9 million RLUSD in the same way without any delegation. About two and a half hours later, Binance's wallets on the Avalanche and Polygon chains also made similar transfers.

These wallets use different blockchains, key types and signature schemes. All wallets generated valid signatures for the attacker within about half an hour. TRM's assessment believes that the most likely scenario is that the attacker gained the ability to make Binance's hot wallet signing system sign cross-chain transactions of their choice.

Stablecoin issuers took quick action. 37 minutes after the hacker launched the attack, Tether, Circle, Ripple and World Liberty Financial held by the Trump family successively froze stablecoins worth about 2.67 billion U.S. dollars, and Arbitrum's Security Council also froze Ethereum and ARB worth about 30 million U.S. dollars, totaling about 2.7 billion U.S. dollars. But the attacker still controls more than 420,000 Ethereum and 18,270 Bitcoins, worth about 2.4 billion U.S. dollars, in addition to controlling a small amount of assets on other chains.

Stablecoin issuers such as Circle or Tether will first destroy the frozen stablecoins so that they cannot be accessed by hackers. Then they can reissue new stablecoins, which can be stored in legitimate government agencies before being returned to Binance.

But the hackers reacted very quickly, and they are using crypto obfuscation technology and global money laundering networks to convert cryptocurrencies into fiat currencies.

In the first few hours, the attacker exchanged stablecoins that might be frozen at a very high cost at a discount for crypto assets that issuers cannot track. About 325 million USDT was sold or mortgaged to professional market makers and order book traders in exchange for about 122,300 Ethereum. This means the discount exceeds 10%.

It is worth noting that blockchain analysis firm Chainalysis has also found a previously undiscovered money laundering pattern — stolen funds circulate repeatedly between different addresses, and often return to previously used wallets, which may indicate automated operations to confuse investigators. Chainalysis also found that these funds are mixed with the proceeds from the Bitget digital asset trading platform exploit incident in September, and it is likely that the same hacker is responsible.

Idan Ofrat, Chief Product Officer and Co-founder of digital asset security infrastructure platform Fireblocks, told *Caijing* that the main lesson learned from this incident is that no single developer or operation and maintenance machine should have the unilateral right to deploy or change wallet permissions.

In his view, the Binance vulnerability shows that security cannot rely on perimeter defense, nor on implicit trust in internal development tools. To protect institutional assets, every terminal or server must be treated as a potential breach point, operation and maintenance roles must be separated, a strict policy quorum mechanism must be implemented, and with the help of real-time transaction transparency, unauthorized signatures can be intercepted before they are sent to the blockchain. These controls are only effective when configured correctly, so they should be continuously verified, not just verified at initial setup.

02

AI Has Greatly Improved Hackers' Attack Capabilities

Cryptocurrency exchanges hold billions of dollars worth of customer assets, and have always been one of the main targets of hacker attacks, because the benefits of attacking exchanges are direct and immediate. However, the amount of loss Binance suffered this time far exceeds that of similar previous attacks.

What particularly worries investors is that in an era where artificial intelligence models are released every two weeks, hackers' ability to discover trading vulnerabilities and launch attacks is improving rapidly, making security issues in the cryptocurrency field particularly severe.

Ofrat analyzed that October was an important month for the cybersecurity field, and multiple major vulnerabilities were disclosed, including php2shell, HTTP2Shell, the compromise of the eMudhra certificate authority, etc. AI is enhancing attackers' capabilities and may accelerate vulnerability discovery. It is exactly these enhanced tools and vulnerabilities that allowed attackers to gain an initial foothold on the engineer's machine, which was the very starting point of Binance's attack.

"All cryptocurrency companies need to build a security posture strong enough to withstand the waves of incidents coming in the next few months," Ofrat said.

Other recent cyberattack cases have not reached the scale of Binance's incident.

At the end of September, cryptocurrency exchange Bitget was hacked. The attacker exploited a "zero-day vulnerability" in a third-party security product used by the exchange, successfully invaded Bitget's infrastructure, resulting in unauthorized transfer of assets in some hot wallets and warm wallets on multiple of its chains. The total loss caused by this incident was about 388 million U.S. dollars. Bitget took response measures after the incident, and launched mechanisms such as a protection fund to deal with risks and try to compensate affected users to maintain platform trust.

In late October, Polymarket, a blockchain-based prediction market platform, suffered a major cyberattack. Hackers exploited a vulnerability in a third-party service provider used by the platform to break in. The attackers stole funds from some traders' accounts, with an estimated 700 affected users and a total stolen amount of about 2.7 million U.S. dollars. After discovering and fixing the security issue, Polymarket has resumed trading and promised to compensate affected users.

After the Binance incident, the world's major cryptocurrency exchanges rushed to strengthen security measures and assured customers that their funds are safe.

Yi He, co-founder of Binance, said on social media that Binance will cooperate with law enforcement agencies around the world to investigate the attack team and recover stolen funds, while increasing investment in security.

Will Megson, Vice President of Product at Coinbase, a cryptocurrency exchange, publicly stated that the company has made a "major upgrade" to its mobile protection features to "protect users from scam calls". He said: "Scammers usually try to guide victims to change settings over the phone."

Due to Binance's industry status, this theft incident is expected to have an important impact on the entire industry. Users convert traditional currencies into Bitcoin, Ethereum and other types of cryptocurrencies through exchanges like Binance. Binance also plays a role similar to a bank. Customers store assets on Binance and rely on the exchange to ensure the safety of their funds. Binance's 2025 annual report shows that it has 335 million registered users worldwide, with about 162.8 billion U.S. dollars in custodial assets.

Binance is trying to calm market sentiment. Yi He introduced on social media that the affected assets of more than 3 billion U.S. dollars only account for about 2% of the total of Binance's user assets and public reserves.

Previously, some cryptocurrency exchanges went bankrupt due to improper handling of network vulnerabilities.

Mt. Gox (nicknamed "Men Tou Gou") in Japan, once the world's largest Bitcoin exchange, suffered its first large-scale intrusion in 2011. Due to the company's technical architecture loopholes and extremely weak security management, over several years, Mt. Gox not only failed to detect the continuous outflow of funds, but even covered up the fact that it was already insolvent. In February 2014, Mt. Gox suddenly suspended all Bitcoin withdrawals, then announced that about 850,000 Bitcoins were lost, and filed for bankruptcy protection.

The Mt. Gox incident once caused Bitcoin prices to plummet, and made early investors have great distrust of centralized exchanges, prompting the industry to start paying attention to security technologies such as cold storage and multi-signature. In the following years, Mt. Gox went through an extremely long bankruptcy liquidation and legal proceedings. The bankruptcy trustee spent years of efforts to recover part of the stolen or lost Bitcoins, and has successively compensated affected users.

This article is from the WeChat official account "Caijing Magazine", author: Guo Liqin, editor: Zhu Tao, 36Kr is authorized to publish it.