Skip to content
Sign in
Technology · Asia Pacific

Binance says $6.3 billion was stolen as breach points widen

Binance reported that attackers moved $6.3 billion from its cryptocurrency wallets across ten blockchains. The exchange said about $3 billion had been frozen, while it later identified additional points of breach.

AI-assisted synthesis · Based on 4 independent reports from 7 outlets · Article text read from 2 of 4 reportsHow it's made

View timeline · 6 entries
7 outlets2 regionsLatest reporting 2 min readNo new reporting in 4 days
Coverage: Center OnlyL 0 · C 6 · R 1
File photo
Photo: Bretwa / Wikimedia Commons (CC BY-SA 4.0)

What happened

Key facts

  • The reported theft from Binance amounted to $6.3 billion (per abplive.com, New York Post, CBS News).
  • The stolen funds were moved from Binance wallets across ten blockchains, with most transferred in about 20 minutes (per abplive.com).
  • Binance said approximately $3 billion had been frozen after the theft (per abplive.com).
  • Binance initially said the theft may have involved an engineer’s laptop and later reported finding additional points of breach (per New York Post).
  • Ido Ben-Natan, CEO of Blockaid, said he would not rule out an inside job and described phishing or arranging for someone to join Binance as possible ways into its network (per New York Post).
  • On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper under the attacker’s control, with 50 pre-signed authorizations prepared in advance (per abplive.com).

The brief

Binance reported that attackers moved $6.3 billion from its cryptocurrency wallets across ten blockchains, with most of the transfers taking place in roughly 20 minutes. The exchange said it had frozen about $3 billion after the theft.

Blockchain intelligence firms linked the operation to North Korean hackers, but the attribution is an assessment rather than an established identity of the people responsible. Binance’s account of how the breach unfolded developed as the exchange reported finding more entry points.

It initially said the theft may have centered on an engineer’s laptop; it later said it had identified “additional points of breach.” That later disclosure broadens the possible access picture, but does not by itself establish how many people took part.

On Ethereum, the attacker used an EIP-7702 delegation to convert a Binance hot wallet into a sweeper under their control, according to the exchange’s technical description. Binance said 50 authorizations had been prepared in advance. The transfers then spread across ten blockchains, and most of the reported $6.3 billion moved in about 20 minutes.

Ido Ben-Natan, CEO of Blockaid, said he would not rule out an inside job. He described phishing and getting someone hired at Binance as possible ways to penetrate the company’s network. Those are scenarios he raised, not findings that establish either route occurred.

Ben-Natan also judged that North Korean hackers most likely used artificial intelligence, while the method remained uncertain. His assessment adds a possible technology angle to the suspected North Korean attribution, but the reports do not establish that AI was used in the breach.

The reported scale exceeds the previous record cited by ABP Live, which described the $1.5 billion Bybit hack in February 2025 as the prior largest. Binance’s reported freeze of approximately $3 billion is the clearest documented consequence for recovery; the accounts do not specify how much of the remaining amount was recovered or who ultimately controlled the stolen funds.

Why it matters

  • Binance reported a $6.3 billion theft and a freeze of about $3 billion, leaving the exchange’s recovery effort central to the immediate financial stakes.
  • The reported transfers crossed ten blockchains, and most occurred within about 20 minutes, illustrating how quickly the funds moved through multiple networks.
  • Binance’s initial focus on an engineer’s laptop and later disclosure of additional breach points leave the company’s access pathway unresolved.
  • Blockaid CEO Ido Ben-Natan raised insider access, phishing, recruitment, and possible AI use as scenarios or assessments; none is established as the confirmed method.

What to watch next

  • Whether Binance identifies how the additional breach points were accessed.
  • Whether Binance reports recovering or freezing more of the stolen funds beyond the approximately $3 billion it cited.
  • Whether blockchain analysis firms provide further evidence for the suspected North Korean attribution.
  • Whether Binance or investigators establish whether the breach involved phishing, insider access, recruitment, or artificial intelligence.

How it's being covered

Coverage analysisShow details
7 source articles · 7 unique outlets · 4 distinct reports
Outlet political mix: Center Only· 6 Center · 1 Right
Where the outlets are based: US/Canada 43% · Unknown 43% · Other 14%
Outlet political mix
Center Only
Left
Center
Right
0 outlets
6 outlets
1 outlet
The marker shows coverage balance: each unique outlet counts once.
Geography
Where the outlets covering this story are based.
7 unique outletsDominant coverage: US/Canada
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (6 of 7 rated sources); comparatively few Left-rated outlets have published on the event.
How we measure coverage

How outlets' accounts compare

1 framing difference · 2 uncorroborated claims · 4 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 2 reports whose article text Updat3 read; 2 other outlets were checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • ABP Live emphasizes the technical mechanism on Ethereum, the ten-blockchain transfers, and the reported freeze; the New York Post emphasizes the possible engineer-laptop access, additional breach points, and Ben-Natan’s theories about insider access and AI.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • Binance said it found “additional points of breach.”
  • Ben-Natan said he would not rule out an inside job and considered AI use by North Korean hackers most likely, while the method remained uncertain.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The reports do not describe the impact on individual Binance customers or provide a breakdown of customer losses.
  • They do not identify a law-enforcement investigation, court process, or named public finding establishing who carried out the theft.
  • The suspected North Korean responsibility is an attribution, not a confirmed identification of the attackers.
  • The engineer-laptop theory, possible inside involvement, and possible use of AI remain uncertain; Ben-Natan presents access routes and AI use as possibilities or an assessment.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Binance launched its cryptocurrency exchange.
    Background · compiled and fact-checked by Updat3
  2. On April 14, 2022, the FBI attributed the theft of about $620 million from the Ronin Network to North Korean state-sponsored hackers.
    Background · from our historical context
  3. Ethereum’s EIP-7702, proposed in May 2024, introduced a way for an externally owned account to temporarily use smart-contract code.
    Background · from our historical context
  4. On Feb. 21, 2025, attackers stole about $1.5 billion in cryptocurrency from Bybit, then the largest publicly reported crypto theft.
    Background · from our historical context
  5. The FBI attributed the Bybit theft to North Korean actors it called “TraderTraitor.”
    Background · compiled and fact-checked by Updat3
  6. The Ethereum Pectra upgrade activated the change on May 7, 2025, making the feature part of the network’s rules.
    Background · from our historical context

How we got here

On Feb. 21, 2025, attackers stole about $1.5 billion in cryptocurrency from Bybit, then the largest publicly reported crypto theft. On Feb. 26, the FBI attributed the operation to North Korean actors it called “TraderTraitor”; the episode established a recent precedent for thefts involving major exchanges.

Ethereum’s EIP-7702, proposed in May 2024, introduced a way for an externally owned account to temporarily use smart-contract code. The Ethereum Pectra upgrade activated the change on May 7, 2025, making the feature part of the network’s rules. On April 14, 2022, the FBI attributed the theft of about $620 million from the Ronin Network to North Korean state-sponsored hackers.

Original sources

3 of 7 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.