Binance hacker attack: $6.3 billion in damages at world's largest cryptocurrency exchange
Hackers have stolen assets worth an estimated $6.3 billion from the cryptocurrency exchange Binance. The company has announced it will replace all losses.
Major attack on Binance reveals massive security flaw
According to t-online.de, the world's largest cryptocurrency exchange Binance has suffered a massive hacker attack. On Thursday evening at around 21:14 UTC, 167,464 Ether coins (ETH) worth approximately $388 million US dollars and Stablecoins of the Tether brand (USDT) worth approximately $1.6 billion disappeared from wallets. Analysts estimate the total damage at $6.3 billion – possibly the largest cryptocurrency theft in history.
The stolen assets were transferred to an address that had been created only a few hours earlier. The initial funding of this address came from Tornado Cash, a crypto-mixer designed to obscure money flows. For security experts, this pattern is characteristic of professional hacker attacks. The actual extent of the damage cannot currently be determined with precision: estimates range between $2.8 billion and $6 billion, depending on which wallets and assets are taken into account. Even the more conservative estimate significantly exceeds the previous record – in February 2025, attackers at the Bybit exchange stole approximately $1.5 billion.
Binance founder Changpeng Zhao confirmed the hacker attack on X (formerly Twitter) immediately. The company announced it would replace all user losses from its emergency fund. At the same time, Binance temporarily suspended all deposits and withdrawals to conduct security checks and prevent further outflows.
According to the exchange's initial findings, the security flaw was caused by a hacked laptop belonging to a DevOps engineer. The attacker thereby gained access to a service container and subsequently triggered unauthorised withdrawals. Binance emphasises that it has found no evidence that private wallet keys were compromised. A detailed technical analysis will be published once the investigation is completed.
According to analysts, the attacker exploited an Ethereum function that enables wallets to temporarily execute extended commands. Through apparently unauthorised permissions that were granted, the perpetrator gained access to multiple Binance wallets. How the attacker obtained these permissions and whether Binance itself made mistakes remains unclear.
A large portion of the stolen assets has already been frozen – for example the Stablecoins. However, approximately 195,000 Ether remains with the attacker. Unlike Stablecoins, no one can centrally block Ether. Observers expect the perpetrator will attempt to launder these holdings through decentralised exchanges or specialised platforms.
Binance has the SAFU fund (Secure Asset Fund for Users), which was established in 2018 and currently contains approximately 15,000 Bitcoin – just over a billion dollars. Based on current damage estimates, this fund alone is insufficient. How Binance intends to close the gap remains unclear for now. Users must for the time being await when the exchange will reopen deposits and withdrawals.
This is not the first attack on Binance. In May 2019, hackers stole approximately 7,000 Bitcoin using stolen API keys and two-factor codes, then worth approximately $40 million. Binance fully replaced this damage from the SAFU fund. In October 2022, attackers exploited a security flaw in the BNB Chain bridge and generated BNB worth approximately $566 million, but were only able to withdraw approximately $137 million before transactions were halted. The current attack exceeds both previous incidents by a significant margin.
Source: Frankfurter Allgemeine Zeitung