Summary
Binance has begun restoring withdrawals after a reported theft of roughly $6.3 billion in crypto assets from hot wallets across multiple networks. The exchange says it has replaced most affected assets, while blockchain researchers and U.S. authorities continue to examine how the attack unfolded and who was responsible.
A major hot-wallet incident with an unsettled record
Binance has started restoring withdrawals after reporting a large-scale theft from hot wallets operating across several blockchain networks. The exchange first restricted parts of its deposit and withdrawal system while it assessed the incident, then reopened services in stages for networks including Bitcoin, Ethereum and BNB Smart Chain. Binance has said that it will absorb the financial impact and that customer losses will not be passed on to users.
The public record is not fully consistent on the size of the incident or the amount of replacement coverage. An independent blockchain reconstruction put the loss at approximately $6.28 billion, while media reports have described the event as a roughly $6.3 billion or $6.4 billion hack. Binance initially said that about 90% of affected assets had been restored or backed, and later reported coverage of approximately 95%. Those figures should not be read as proof that the attacker’s funds have been recovered. They describe the exchange’s effort to restore backing for customer balances, using sources that Binance said included its Secure Asset Fund for Users, a futures insurance fund and corporate treasury resources.
The remaining assets may be harder to replace because some are less liquid or more difficult to source at scale. Binance has said it will continue using market and over-the-counter channels to address the outstanding amount. That approach may restore customer asset support, but it does not resolve questions about the original intrusion, the movement of stolen funds or the controls that allowed the incident to occur.
What the blockchain timeline shows
A reconstruction published by CertiK engineer and SEAL member Dickson described preparation activity before the main transfers. According to the analysis, wallets associated with the attackers withdrew small amounts of ETH from Tornado Cash, deployed a sweeping contract and tested the process using their own wallets. The report is an independent interpretation of public blockchain data, however, and its timing, amounts and explanation of the attack vector should be distinguished from Binance’s internal forensic findings.
The analysis estimated that approximately $6.07 billion moved during the first 55 minutes. One Ethereum wallet was then swept repeatedly for more than two additional hours. The reported assets were spread across Ethereum, Bitcoin, Tron, XRP, Solana, Arbitrum, Avalanche and Optimism. They included major stablecoins and native assets as well as numerous smaller tokens.
The Ethereum transfers have drawn particular attention because the researchers believe the attackers may have used authorization capabilities associated with EIP-7702 to control the transfer logic of a targeted wallet. A sweeping function can batch large numbers of token transfers, allowing an attacker to move assets quickly once the relevant permission has been obtained. Blockchain records can show the transactions and the sequence of wallet activity, but they do not by themselves establish whether the initial compromise involved a leaked private key, a compromised signing device, a malicious authorization or an operational system.
Some reporting has pointed to possible compromises involving hot wallets and devices used by development or operations personnel. Those details remain subject to formal investigation. The distinction matters: a transaction signed on-chain is evidence that a permission was exercised, not necessarily evidence of how the permission was acquired.
Freezes can slow the loss, but cannot reverse it automatically
Tether, Circle, Ripple, Paxos, World Liberty and Binance were reported to have frozen approximately $2.8 billion in assets connected to the incident. Stablecoin issuers can take action at the smart-contract level for tokens they control, creating a race between attackers attempting to move or convert funds and issuers trying to identify and block relevant addresses.
A freeze is not the same as recovery. Native Bitcoin and Ether cannot be frozen by a stablecoin issuer. In a multi-chain environment, funds can also be split across new wallets, exchanged for different assets, bridged to other networks or moved through less liquid over-the-counter venues. Once those steps occur, tracing may remain possible, but legal control, technical intervention and actual restitution become separate challenges.
The reported distribution of the stolen assets illustrates that problem. The affected balances included large amounts of USDT and USDC, but also BTC and ETH, which cannot be immobilized by a centralized token issuer. The continued movement of those assets can complicate both enforcement and the calculation of what has been recovered.
The episode therefore demonstrates both the value and the limits of blockchain transparency. Public ledgers allow researchers, exchanges, issuers and law-enforcement agencies to follow transactions quickly. They do not automatically prevent a theft, identify the original point of compromise or guarantee that a marked address can be stopped across every asset and network.
Withdrawal restoration is a security process, not just a service decision
Binance’s phased reopening reflects the operational difficulty of restoring a large exchange after a wallet incident. According to the company, the decision to restrict withdrawals was intended to contain losses, assess the scope of the event, restore affected services and complete security checks. Users were warned to expect temporary delays and longer processing times as traffic returned.
For an institutional wallet or custody platform, the main lesson is that hot-wallet exposure is a systems problem rather than a single-key problem. Hot wallets provide the liquidity needed for routine withdrawals, but their online status increases exposure to private-key management systems, signing infrastructure, automated policies and operations devices. Controls generally need to work together: segregated permissions, transaction limits, rate controls, multi-party approval, address allowlists, anomaly detection and emergency suspension procedures.
EIP-7702 and similar authorization capabilities broaden the scope of wallet reviews. Security teams must examine not only whether a private key has been exposed, but also which delegations are active, what code can execute on behalf of an account, how authorizations can be revoked and whether a single permission can affect assets on multiple networks. Continuous monitoring of unusual approvals and batch transfers becomes as important as monitoring withdrawals themselves.
No single control eliminates the risk. The central question is whether an attacker who gains access to one component can use it to move a large portion of assets across multiple chains. Separation between operational systems and signing environments, strict limits on hot-wallet balances and rapid escalation paths can reduce that blast radius, but they require disciplined implementation and regular testing.
Attribution and the regulatory aftermath
The FBI said it had determined that North Korea was responsible for the theft. Public attribution by a national law-enforcement agency is significant, but the available material does not yet provide a complete account of the intrusion or publicly establish the role of every address, service or intermediary involved in the subsequent transfers.
The incident is likely to intensify regulatory scrutiny of offshore exchanges and cross-border crypto infrastructure. Questions may include how customer assets are segregated, how much value is held in hot wallets, how exchanges disclose cyber incidents, how delegated wallet permissions are governed and how quickly platforms can coordinate with issuers and law-enforcement agencies.
Asset replacement can protect customers from an immediate shortfall, but it does not substitute for a transparent explanation of the control failure. For institutional custody providers, useful evidence of resilience will include clear incident reporting, verifiable asset coverage, independently reviewed recovery procedures and demonstrable separation between transaction operations and signing authority.
The resumption of withdrawals marks a transition from emergency containment to service recovery, not the end of the event. Fund tracing, forensic analysis, responsibility attribution and long-term remediation remain outstanding. The broader consequence will depend not only on how much of the stolen crypto is ultimately immobilized or recovered, but also on whether exchanges and custodians turn the incident into stronger, testable standards for authorization management, hot-wallet limits and cross-industry response.
Source: link