Cyberattack against Binance: how hackers stole $6.3 billion worth of digital assets from the world's leading cryptocurrency platform
On the evening of October 29, the cryptocurrency giant was the victim of a massive cyberattack. Conducting its investigation into this incident, the platform has already revealed the first clues, speaking of a…
The night was not easy for Binance. It was even very turbulent for the cryptocurrency giant (and even world leader in terms of spot exchange volume), victim of a cyberattack on the evening of October 29. In total, $6.3 billion in digital assets were lost.
The platform has since been carrying out an investigation to shed light on this incident, multiplying announcements on social networks in recent hours. “Our preliminary investigation suggested that this security incident could be linked to the compromise of a computer. However, our subsequent investigations revealed additional breach points,” she revealed on X, in an effort for necessary transparency.
“This was a complex attack,” the company continued. But how could Binance have suffered this massive cyberattack. Explanations.
Point of intrusion As the platform initially explained on Elon Musk's social network, everything started from a laptop belonging to a DevOps engineer (contraction of "software development" and "IT operations") which was compromised. This “allowed an attacker to access a service container and submit unauthorized withdrawal transactions,” the company wrote. This modus operandi is also one of the signs pushing blockchain analysis companies like Chainalysis and TRM Labs to attribute the cyberattack to the North Korean hacker group “TraderTraitor”, also known as “Lazarus”.
He is known to have targeted "repeatedly the cryptocurrency sector (...) as well as investors, in order to raise funds for the regime", recalls Chainalysis in its first conclusions linked to the Binance incident. The FBI also attributed the hacking of the Bybit cryptocurrency platform in February 2025, with $1.5 billion stolen.
The US federal agency specified in a cybersecurity advisory at the time that one of the group's tactics to break into the systems of cryptocurrency companies was to send a "large number of targeted phishing messages" to their employees. Not just any employee, but those often occupying positions in system administration or DevOps, she specified. So act.
This is what happened with Binance. “There is a long phase of gathering information, to find out who has access to what and then targeting the people identified as allowing them to enter the system,” explains Renaud Lifchitz, scientific director of the cybersecurity consulting firm Holiseum. The engineer who was trapped by the North Korean hacker group is in charge of the internal infrastructure of the cryptocurrency platform.
He thus has access to control what are called hot wallets, indicates the cybersecurity and cryptocurrency expert. “Platforms always separate their funds between hot wallets and cold wallets. Hot wallets are connected to the internet, which allows deposits and withdrawals to be made on the platform.
Method: reports are grouped by the words of their headline and summary; each newsroom counts once; figures are read from the reports as published. Nothing here is written by an AI.
"Cold wallets are funds that are currently not active, which are decommissioned and disconnected from the internet to secure them," he explains. And these are obviously the first to be emptied. A complex attack The hackers, once they entered the Binance system, used various complex techniques to achieve their ends.
Proof that this is not an amateur group, insists Renaud Lifchitz. To begin, a wallet was provisioned a few days before the hack. Because "to initiate an attack, you must have initial funds, in particular having gas (fees to pay, Editor's note) to carry out the transactions", says the expert in cybersecurity and cryptocurrencies.
The people behind this wallet then used the Tornado Cash mixing service, which allows transactions to be anonymized, to provision it. “It’s the mixer most used by Lazarus-type groups active in North Korea,” points out Renaud Lifchitz. It is therefore impossible to know where the initial funds came from.
The pirates did not stop there in their ploy. “The attacker didn't just use the permissions of a single engineer, and it wasn't a single 'one-click' action,” emphasized Richard Teng, co-CEO of Binance on X. Specifically, they took advantage of an Ethereum platform update dating back to May 2025.
With it came a function called “EIP-7702”, which allows you to have a wallet that behaves like a “smart contract” (“intelligent contract”, in French). It is a standalone computer program stored on a blockchain that runs automatically whenever specific conditions are met. “This function was exploited in the attack, making it possible to reuse an authorization to make several debits without having to sign each debit,” explains the cybersecurity and cryptocurrency expert.
The hackers were also clever in the funds they stole from several blockchains (Ethereum, etc.). “Among the funds that were stolen, there are tokens and cryptoassets native to blockchain,” notes the scientific director of Holiseum.
An important distinction because the former are what are called smart contracts. However, unlike the latter, they can be frozen remotely, thanks to a “kill switch”. Concretely, the issuer of a token can freeze funds in an account in the event of theft.
This is also what happened with the Binance cyberattack. The boss of Tether, which issues the most used stablecoin in the world (USTD), announced on the evening of October 29 that it had frozen around 1.6 billion of these assets. Similarly, Circle, which oversees the USDC cryptocurrency, has tied up around $800 million.
Cryptoassets native to blockchain, like bitcoin, cannot be frozen remotely. And the pirates took advantage of it. “They posted a guarantee of frozen funds just before they were frozen to borrow, via loan systems, funds that cannot be frozen,” relates Renaud Lifchitz.
What risks for users? Thus the hackers achieved their goals, with damage estimated at 6.3 billion dollars. Binance, however, quickly assured that it had frozen half of these funds to avoid a massive theft.
The cryptocurrency giant has since continued to issue mixed messages about funds deposited by customers. After asserting that they were "totally safe", he pledged to cover "all losses". “Binance has begun recovering affected assets for users and continues to collaborate with law enforcement, issuers, blockchain analytics companies and industry partners to trace, freeze and recover additional funds,” the platform said on October 30.
But what are its customers really risking? One of the dangers comes from freezing funds. “In theory, if x% of funds have been frozen on Binance, users risk being drained of these x%.
(...) It's a bit like being a shareholder and having a depreciation of the assets of a company, so everyone is affected by the same percentage", explains Renaud Lifchitz. But the company is committed to reimbursing its customers, in particular with the SAFU (Secure Asset Fund for Users).
The latter was created in July 2018 to protect customer assets in the event of incidents affecting the platform. “In 2026, the SAFU fund consists of cryptoassets valued at approximately one billion dollars, held entirely in bitcoins,” the company certifies on a dedicated page which was updated on October 13. “This fund could be used to absorb part of the compensation,” as the cybersecurity and cryptocurrency expert indicates.
And for the rest? In its latest message, the platform certifies that it will also use its own funds to reimburse customers. “Binance has already set aside over $6.34 billion in equity to cover this incident,” she wrote.
“These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification,” she added. In the meantime, however, users have the option of recovering those that have been frozen by issuers. “When we freeze USDT, we can ask Tether to obtain the real dollars behind these frozen tokens since they cannot be claimed twice.
We are therefore certain that they are exchangeable after having been frozen", maintains the scientific director of Holiseum. But while Binance has not yet shed any light on this massive cyberattack, its clients will have to be patient before they can recover all of their funds.
