Binance hack triggers $3.64B withdrawal wave, FBI and Secret Service probes open
Security & Exploits ·
A roughly $6.4 billion theft from Binance's hot wallets has sparked a government investigation and a sharp retreat of customer funds from the exchange.
Attackers linked to the North Korea-connected group TraderTraitor pulled the funds across about 10 blockchains, with the bulk of the theft happening within a 20-minute window on a Thursday afternoon, according to Decrypt. The sum dwarfs the prior largest exchange theft, the $1.5 billion taken from Bybit in February 2025, and both exchanges point to the same North Korea-linked actor. Binance initially traced the breach to a compromised laptop used by a DevOps engineer before acknowledging "additional points of breach." On Ethereum specifically, the attacker exploited 50 pre-signed authorizations to convert a Binance hot wallet into a self-draining contract — a failure in Binance's internal signing approvals rather than any flaw in Ethereum itself. No private keys were exposed, and the attacker erased its tooling before exiting.
Once withdrawals resumed over the weekend, more than $3.64 billion left the exchange, based on figures cited from QCP. Binance's chief executive, Richard Teng, said the company will cover losses entirely from corporate reserves and its SAFU fund, with $6.34 billion already allocated for reimbursement. CZ characterized the episode as painful but survivable for the exchange.
The fallout spread quickly into traditional crypto investment products. Bitcoin ETFs lost $643.3 million in a single Friday session, the heaviest daily outflow of the month, snapping a four-day run of inflows and dragging October's total from a positive $127 million to a negative $515.9 million — a reversal from September's $2.65 billion in net inflows. Ether ETFs fared worse, shedding $1.61 billion over the month in what was their weakest month since launch, extending an 11-session losing streak into the weekend.
Regulatory attention followed the losses. CFTC Chairman Michael Selig told CNBC the incident validates concerns about unregulated offshore exchanges lacking adequate safeguards, proposing a federal registration pathway requiring US cybersecurity standards; he noted the breach originated from a compromised laptop rather than the blockchain itself. The FBI and Secret Service have both opened formal investigations.
Separately, blockchain analysis from WuBlockchain indicates the hacker has been laundering the $6.43 billion across 11 chains using CoinJoin mixing techniques, with authorities managing to freeze 44% of the stolen funds so far. Still unresolved are the full scope of Binance's internal security gaps, the outcome of the FBI and Secret Service probes, and whether Binance's reported need to buy roughly $1.3 billion in BTC, ETH, and BNB to replenish reserves will further pressure markets already reeling from the hack's aftermath.